This vulnerability exists in the Oracle Text component of Oracle Database Server and is exploitable by an attacker with low privileges (Create Index privilege) and network access via Oracle Net. Exploitation can lead to complete compromise of Oracle Text and potentially affect other Oracle products due to scope change. The vulnerability affects Oracle Database Server versions 19.3 to 19.32, 21.3 to 21.23, and 23.4.0 to 23.26.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains numerous security patches across multiple products. The vendor strongly recommends applying the patch without delay to mitigate risk.

Successful exploitation allows an attacker with low privileges and network access to take over the Oracle Text component, potentially leading to full compromise of Oracle Text and impacting other Oracle products. The vulnerability affects confidentiality, integrity, and availability of the affected systems, as reflected by the CVSS score of 8.5. This can result in unauthorized data access, data modification, and service disruption.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the vendor advisory.