A vulnerability in the Application Expert UI component of Oracle Trusted Answer Search allows an attacker with only low privileges and network access via HTTP to compromise the application and read all data exposed through Oracle Trusted Answer Search, thereby compromising confidentiality. The CVSS 3.1 vector indicates an attack vector of network, low attack complexity, low privileges required, and no user interaction, resulting in a Base Score of 7.7.

The affected product is Oracle Trusted Answer Search version 26.1. The vulnerability is specifically located in the Application Expert UI component and may also impact additional Oracle products due to a scope change.

The CVSS score of 7.7 denotes a high severity risk. The EPSS score of <1% indicates a very low but nonzero likelihood of exploitation, but the lack of KEV listing suggests no publicly known exploits. The remote nature and low attack barrier mean the risk remains significant. Attackers only need network to the application, with low privileges, to exploit this flaw and gain unauthorized access to sensitive data.