Oracle patches eight Trusted Answer Search flaws; two score 9.9 but require low privileges

Eight fixes, three very different access conditions

Oracle's 20 October 2026 Critical Patch Update lists eight new security patches for Trusted Answer Search 26.1. Two entries, CVE-2026-101501 and CVE-2026-101503, each have a CVSS v3.1 base score of 9.9. Both require an attacker to have low privileges and network access through Oracle Net. The one entry Oracle identifies as remotely exploitable without authentication is CVE-2026-101498, scored 8.1. These are different exposure conditions, not eight interchangeable paths into the product.

The risk matrix describes what successful attacks could do. It does not state that any of these eight flaws have been exploited, identify affected customers, provide a campaign timeline or disclose a working attack path. A high score is a severity estimate under specified conditions, not evidence of an intrusion. Oracle's wider October update lists 1,295 new security patches across product families; that is a count of patches, not a count of unique CVEs or breached systems.

What the product does, and why the boundary matters

Oracle's product overview describes Trusted Answer Search as a natural-language interface that maps a question to a curated search target: for example, an approved report, URL or SQL-driven view. An application then decides how to render that result. It combines lexical and semantic retrieval and can optionally use an LLM for re-ranking or parameter extraction. It is not simply a chatbot generating free-form answers.

The documented deployment has an administrator APEX application, a user portal, embeddable widgets, a search API and a back end built on Oracle AI Database 26ai. Oracle says the target application remains responsible for the end user's authorisation. This matters because the October matrix names two distinct affected surfaces: the PL/SQL package and the application expert UI. It does not show the exact faulty code or prove that a natural-language question by itself can exploit any of the listed CVEs.

The practical trust question is therefore narrower than the product name suggests. Which accounts can use the PL/SQL package over Oracle Net, which users can reach the expert UI, and which functions or data can those identities reach? A curated answer catalogue may constrain normal search results, but its label does not substitute for checking the access controls around the package and management interface.

The eight entries in Oracle's risk matrix

The following is a condensed reading of Oracle's risk matrix and text descriptions. Scores are CVSS v3.1 base scores. The access conditions reflect Oracle's remote-exploit designation and CVSS vectors, not a measure of internet exposure. A deployment can still restrict a service by network policy.

Oracle Trusted Answer Search 26.1, October 2026 CPU. All eight rows are Oracle's entries; access conditions are condensed from the matrix and text form.

CVE	Component and route	Access condition	CVSS
2026-101503	PL/SQL package, Oracle Net	Low privileges; network; no user interaction	9.9
2026-101501	PL/SQL package, Oracle Net	Low privileges; network; no user interaction	9.9
2026-101505	Expert UI, HTTP	Low privileges; another person must interact	8.7
2026-101498	PL/SQL package, Oracle Net	No authentication; network; high attack complexity	8.1
2026-101506	Expert UI, HTTP	Low privileges; network; no user interaction	7.7
2026-101504	Expert UI, HTTP	Low privileges; another person must interact	7.6
2026-101507	PL/SQL package, HTTP	Low privileges; network; no user interaction	6.5
2026-101502	PL/SQL package, local	Low privileges; local logon; another person must interact	5.0

The two 9.9 entries are not identical. Oracle's text matrix says CVE-2026-101503 could permit takeover of Trusted Answer Search. For CVE-2026-101501 it describes critical-data modification, limited data reading and a repeatable crash, with potential impact beyond the product. Both list scope change, high integrity and availability impact, and low-privilege access. By contrast, CVE-2026-101498 needs no credentials but is marked high attack complexity; Oracle says a successful attack could lead to takeover. That difference explains why its base score is 8.1 despite the unauthenticated condition.

Three entries sit in the application expert UI, which Oracle's documentation associates with people who curate and manage search targets. Two of those entries require another person's interaction. The matrix does not say what screen, request or action triggers that interaction. The eighth entry is local and also requires another person's interaction. Those prerequisites should remain visible in any risk discussion instead of being collapsed into the word 'critical'.

What the public record establishes and leaves open

Read from Oracle's 20 October advisory and product documentation on 21 October 2026.

Established by Oracle	Not established by the public record
Eight new Trusted Answer Search patches; affected supported version 26.1.	The number of deployed or internet-reachable 26.1 instances.
One entry is marked remotely exploitable without authentication.	That this entry has been used in attacks.
Two entries score 9.9 and require low privileges via Oracle Net.	Which customer roles or grants satisfy that prerequisite in a specific deployment.
The matrix identifies component, route, CVSS vector and possible impact.	The root cause, exact exploit sequence or a combined attack chain.
The advisory links product patch availability documents.	A single public fixed version or one universal installation step for every environment.

Oracle's security-alerts page says Critical Patch Updates cover supported on-premises products on a quarterly schedule. Its 20 October announcement urges customers to move to a monthly security patching cycle because Oracle also issues other security updates between CPU releases. Those are operational recommendations. They do not mean the eight Trusted Answer Search fixes were all published monthly or that a cloud service is automatically on the same patch path as an on-premises deployment.

Oracle recommends applying the CPU as soon as possible. Its advisory says limiting network protocols or unnecessary privileges may reduce risk while waiting, but can break application functionality and is not a long-term substitute for a patch. Oracle directs administrators to test such changes outside production. Blocking HTTP alone would not address the Oracle Net entries; conversely, restricting Oracle Net would not by itself address the expert UI entries.

An ordered check for UK security and database teams

For this release, the useful question is not whether the product is called 'Trusted'. It is whether a 26.1 deployment gives an attacker, unauthenticated or with a low-privilege foothold, a route to the exact component Oracle names, and whether the corresponding patch is installed.