CVE-2026-91503 in Database Server
Summary
by MITRE • 10/21/2026
Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in the Virtual Private Database component of Oracle Database Server represents a significant security risk for organizations relying on fine-grained access control mechanisms to protect sensitive data. This flaw affects multiple supported versions, specifically 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3. The core issue lies in the handling of security policies within the VPD subsystem when processing requests transmitted over Oracle Net. An attacker who has obtained low-privileged access to the database can exploit this flaw by leveraging network connectivity to manipulate how policy contexts are evaluated or applied during data operations. This exploitation path is particularly dangerous because it allows a user with minimal initial privileges, such as the ability to create tables, to bypass intended security restrictions and escalate their effective permissions within the database environment.
From a technical perspective, the vulnerability stems from an improper validation or enforcement mechanism in how Oracle Database Server processes certain SQL statements related to table creation or modification when VPD policies are active. The attacker utilizes network access via Oracle Net to send crafted requests that trigger incorrect behavior in the security policy engine. This misbehavior effectively neutralizes the restrictions imposed by Virtual Private Database, which is designed to restrict row-level and column-level access based on user context. By exploiting this flaw, an adversary can circumvent these controls, leading to unauthorized creation, deletion, or modification of critical data that should be protected under existing security policies. The attack does not require complex interaction from a human user, making it highly automatable and scalable across affected systems where the vulnerability is present.
The operational impact of this vulnerability is severe, primarily affecting the confidentiality and integrity of organizational data assets. As indicated by the CVSS 3.1 base score of 8.1, the primary consequences are high impacts on confidentiality and integrity with no direct impact on availability. Successful exploitation allows an attacker to access critical data that was previously restricted or even gain complete access to all VPD-protected information within the database schema. This level of unauthorized access can lead to significant business disruptions, regulatory non-compliance, and potential financial losses due to data breaches. The ability to modify or delete protected data further compromises the integrity of the system, potentially leading to corrupted records or loss of audit trails that are essential for forensic analysis and compliance reporting.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it allows a lower-privileged user to perform actions reserved for higher-privileged roles by bypassing security controls. Additionally, the exploitation method corresponds to ATT&CK technique T1078, Valid Accounts, specifically when combined with lateral movement or privilege escalation tactics within the database layer. The attack vector is classified under Network Access (AV:N) and Low Attack Complexity (AC:L), indicating that it can be executed remotely without specialized conditions beyond having valid low-level credentials. To mitigate this risk, organizations must apply the latest security patches provided by Oracle for their specific version of Database Server immediately. Furthermore, administrators should review network access controls to ensure that only authorized hosts can connect via Oracle Net and enforce strict least-privilege principles when granting Create Table or similar DDL privileges to users who do not require such permissions for legitimate business functions.