Oracle Database Server’s Virtual Private Database component can be manipulated by users who only have Create Table privileges, allowing them to create, delete, or modify access control rules. This flaw bypasses the protection normally enforced by VPD, granting the attacker read, write, or delete capabilities over data that should be restricted. The danger lies in high impacts to confidentiality and integrity, while availability is not directly affected.

Oracle Database Server releases 19.3 to 19.32, 21.3 to 21.23, and 23.4.0 to 23.26.3 are susceptible. These include Oracle’s 19c, 21c, and 23c databases.

The CVSS vector indicates a high‑severity vulnerability with a base score of 8.1 due to the combination of network reachability, low privilege escalation, and lack of user interaction. The EPSS score of < 1% signals a low but non‑zero likelihood of exploitation in the wild, and the flaw is not yet catalogued in CISA’s KEV list. Attackers can exploit this remotely over Oracle Net by performing any Create Table operation, a privilege usually granted to a limited set of users. Successful exploitation can lead to unwarranted creation, deletion, or modification of critical data through VPD rule manipulation.