CVE-2026-83272 in Database Server
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Create Index privilege with network access via Oracle Net to compromise Oracle Text. While the vulnerability is in Oracle Text, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Text. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Text component of the Oracle Database Server, affecting specific supported versions including releases from the 19.x series ranging from 19.3 to 19.32, as well as the 21.x series spanning from 21.3 to 21.23, and select builds within the 23c architecture such as version 23.4.0 through 23.26.3. This flaw represents a critical security weakness that allows for unauthorized access and potential system compromise under specific conditions. The vulnerability is characterized by its difficulty to exploit, which serves as a natural barrier against casual or automated attacks but does not eliminate the risk posed by determined adversaries with sufficient technical expertise.
The attack vector requires an attacker to possess low-level privileges within the database environment, specifically the Create Index privilege, and must have network access via Oracle Net to reach the vulnerable component. This combination of requirements means that while a remote unauthenticated user cannot exploit this flaw directly, any authenticated user with limited rights who can establish a network connection to the database server is capable of triggering the vulnerability. The presence of network accessibility indicates that the attack surface extends beyond local system access, allowing for exploitation over internal or external networks depending on how Oracle Net listeners are configured and exposed.
Successful exploitation of this flaw results in a complete takeover of the Oracle Text component. This outcome signifies a severe breach of security controls where an attacker gains control equivalent to higher-level privileges within that specific subsystem. The impact is not confined solely to Oracle Text; due to architectural dependencies, attacks may significantly impact additional products and services running on or connected to the same database instance. This scope expansion amplifies the potential damage, potentially leading to broader system compromise beyond the initial target component.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 8.5, which classifies it as High Severity. The vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) details the specific characteristics contributing to this score. The Attack Vector is Network, indicating remote exploitability. The Attack Complexity is High, reflecting the difficulty of exploitation mentioned earlier. Privileges Required are Low, meaning minimal database access is needed. User Interaction is None, confirming that no user action such as clicking a link or opening a file is required for the attack to proceed. Crucially, the Scope is Changed, which means the vulnerability allows an attacker to affect resources beyond their original authorization level. The impacts on Confidentiality, Integrity, and Availability are all rated as High, indicating that successful exploitation can lead to unauthorized data disclosure, modification of system state or data, and denial of service conditions respectively.
From a classification perspective, this vulnerability aligns with CWE categories related to improper privilege management and potential buffer overflow or memory corruption issues often found in complex text processing engines like Oracle Text. In terms of the MITRE ATT&CK framework, this scenario maps to techniques involving initial access through valid accounts (T1078) followed by lateral movement or escalation within the database environment. The ability to compromise a core component and impact other products suggests potential for persistence and privilege escalation tactics depending on how Oracle Text interacts with underlying operating system resources and other database services.
Mitigation strategies must focus on both immediate remediation and long-term security hardening. Organizations running affected versions should prioritize applying the latest available patches from Oracle that address this specific vulnerability in the Oracle Text component. Until patching is feasible, access controls should be strictly reviewed to ensure that only essential users are granted the Create Index privilege. Network segmentation strategies should be employed to restrict Oracle Net connectivity to trusted networks and authorized IP addresses, thereby reducing the attack surface for potential remote exploitation. Additionally, monitoring database logs for unusual indexing activities or network connections from low-privileged accounts can aid in early detection of attempted exploits. Regular audits of user privileges and adherence to the principle of least privilege are essential preventive measures against this class of vulnerabilities.