## Summary
CVE-2026-83272 is a vulnerability in the Oracle Text component of Oracle Database Server. A low-privileged attacker with Create Index privilege and network access via Oracle Net may be able to compromise Oracle Text, potentially impacting other products due to scope change.
## Technical Details
- Affected component: Oracle Text within Oracle Database Server.
- Attack prerequisites (as described):
- Network access via Oracle Net (AV:N).
- Low-privileged access with Create Index privilege (PR:L).
- Exploitability: described as “difficult to exploit” (AC:H), but successful exploitation can lead to takeover of Oracle Text.
- Impact characteristics: confidentiality, integrity, and availability are impacted (C:H/I:H/A:H), with scope change (S:C).
## Affected
- Oracle Database Server versions:
- 19.3-19.32
- 21.3-21.23
- 23.4.0-23.26.3
## Impact
- Takeover of Oracle Text is explicitly stated as the outcome of successful attacks.
- Potential for significant downstream impact on additional products due to scope change.
- High severity indicated by CVSS 3.1 base score 8.5.
## Mitigation
1. Apply Oracle’s security patch/updates for Oracle Text in Oracle Database Server for the affected version ranges (19.3-19.32, 21.3-21.23, 23.4.0-23.26.3).
2. Restrict and review database privileges so that only trusted roles/users can obtain Create Index.
3. Limit network exposure to Oracle Net (e.g., restrict inbound access to required clients only) to reduce the likelihood of remote exploitation.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H