CVE-2026-91503 Overview
CVE-2026-91503 is a high-severity vulnerability in the Virtual Private Database (VPD) component of Oracle Database Server. The flaw allows a low-privileged attacker with the Create Table privilege and network access through Oracle Net to compromise VPD-enforced data isolation. Successful exploitation permits unauthorized creation, deletion, or modification of critical data and provides read access to all data protected by VPD policies.
Oracle disclosed the issue in the October 2026 Critical Patch Update. Affected versions span Oracle Database 19.3–19.32, 21.3–21.23, and 23.4.0–23.26.3.
Critical Impact
An authenticated attacker with minimal privileges can bypass VPD row-level security controls to read and modify data belonging to other tenants or security contexts.
Affected Products
- Oracle Database Server 19.3 through 19.32
- Oracle Database Server 21.3 through 21.23
- Oracle Database Server 23.4.0 through 23.26.3
Discovery Timeline
- 2026-10-20 - CVE-2026-91503 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-91503
Vulnerability Analysis
The vulnerability resides in Oracle Database's Virtual Private Database (VPD) feature. VPD enforces row-level and column-level security by dynamically appending predicate clauses to SQL statements issued against protected objects. These policies are the backbone of multi-tenant data isolation inside a single Oracle instance.
An attacker holding only the Create Table privilege can interact with VPD in a way that circumvents policy enforcement. The result is unauthorized read access and the ability to create, delete, or modify data within any object protected by VPD policies the attacker should not reach.
Exploitation requires network access over Oracle Net (TNS listener) and authentication as any low-privileged database user. No user interaction is required, and the attack complexity is low.
Root Cause
Oracle's advisory does not publish internal technical details. Based on the available description, the root cause is improper access control within the VPD policy evaluation path, allowing a user with table creation rights to influence or bypass predicate enforcement on protected objects. This maps to a broken access control weakness class.
Attack Vector
The attacker authenticates to the database over Oracle Net using any account that holds the Create Table system privilege. From there, the attacker interacts with VPD-protected objects or policy functions in a way that evades the row-level predicate injection VPD normally performs.
Because the Confidentiality and Integrity impacts are both High and Availability is unaffected, the resulting compromise targets data exposure and tampering rather than service disruption. No public proof-of-concept or exploit code is available at this time.
See the Oracle Critical Patch Update Advisory - October 2026 for Oracle's official notes on this issue.
Detection Methods for CVE-2026-91503
Indicators of Compromise
- Unexpected CREATE TABLE statements issued by low-privileged accounts that are not developer or application identities.
- Queries from non-privileged sessions returning rows from objects normally restricted by VPD policies.
- Unusual DML activity (INSERT, UPDATE, DELETE) against VPD-protected tables originating from accounts with no documented business need.
- Access patterns from Oracle Net clients outside expected application tiers or jump hosts.
Detection Strategies
- Enable Oracle Unified Auditing on DBMS_RLS policy operations and on all DML against VPD-protected objects.
- Baseline normal query predicates on sensitive tables and alert on sessions returning row counts that exceed the baseline for a given user context.
- Audit all uses of the CREATE TABLE privilege by non-developer accounts and correlate with subsequent access to VPD-protected schemas.
Monitoring Recommendations
- Forward Oracle audit trail and listener logs to a centralized analytics platform for correlation with identity and network telemetry.
- Monitor TNS listener connections for anomalous source IPs, service names, and connect strings outside sanctioned application tiers.
- Track privilege grants and role memberships that include CREATE TABLE and alert on new or unexpected assignments.
How to Mitigate CVE-2026-91503
Immediate Actions Required
- Apply the Oracle October 2026 Critical Patch Update to all affected Database Server deployments as the primary remediation.
- Inventory all database accounts holding the CREATE TABLE privilege and revoke it where it is not strictly required.
- Restrict Oracle Net access to the database listener using network ACLs, sqlnet.oratcp.invited_nodes, and firewall rules.
- Review existing VPD policies and recent DML on protected objects for signs of unauthorized access prior to patching.
Patch Information
Oracle addressed CVE-2026-91503 in the October 2026 Critical Patch Update. Patches are available for Oracle Database 19c, 21c, and 23ai. Refer to the Oracle Critical Patch Update Advisory - October 2026 for the applicable patch bundles and version-specific instructions.
Workarounds
- Revoke the CREATE TABLE system privilege from all accounts that do not require it, as the attack requires this privilege.
- Place VPD-protected schemas behind application-tier accounts only and prohibit direct interactive database logins to those schemas.
- Enforce least-privilege role design and audit GRANT operations that could reintroduce the required privilege to untrusted users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
