Oracle Database Server (October 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370482);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id(
    "CVE-2021-2351",
    "CVE-2025-27820",
    "CVE-2025-67721",
    "CVE-2026-101452",
    "CVE-2026-101477",
    "CVE-2026-101478",
    "CVE-2026-101485",
    "CVE-2026-101510",
    "CVE-2026-101512",
    "CVE-2026-11824",
    "CVE-2026-14456",
    "CVE-2026-14457",
    "CVE-2026-18798",
    "CVE-2026-2673",
    "CVE-2026-28389",
    "CVE-2026-31789",
    "CVE-2026-31790",
    "CVE-2026-40542",
    "CVE-2026-41417",
    "CVE-2026-42578",
    "CVE-2026-42579",
    "CVE-2026-42580",
    "CVE-2026-42581",
    "CVE-2026-42583",
    "CVE-2026-42584",
    "CVE-2026-42585",
    "CVE-2026-42586",
    "CVE-2026-42587",
    "CVE-2026-44248",
    "CVE-2026-49844",
    "CVE-2026-54399",
    "CVE-2026-54428",
    "CVE-2026-54515",
    "CVE-2026-54874",
    "CVE-2026-55956",
    "CVE-2026-56624",
    "CVE-2026-56741",
    "CVE-2026-59889",
    "CVE-2026-63072",
    "CVE-2026-63073",
    "CVE-2026-63074",
    "CVE-2026-63075",
    "CVE-2026-63076",
    "CVE-2026-71497",
    "CVE-2026-73964",
    "CVE-2026-75803",
    "CVE-2026-78030",
    "CVE-2026-87022",
    "CVE-2026-89044",
    "CVE-2026-91479",
    "CVE-2026-91499",
    "CVE-2026-91503",
    "CVE-2026-91563",
    "CVE-2026-91568",
    "CVE-2026-91615",
    "CVE-2026-93492",
    "CVE-2026-93493",
    "CVE-2026-93494",
    "CVE-2026-93560",
    "CVE-2026-93561",
    "CVE-2026-93563",
    "CVE-2026-93564",
    "CVE-2026-93565",
    "CVE-2026-93566",
    "CVE-2026-93567",
    "CVE-2026-93568",
    "CVE-2026-93569",
    "CVE-2026-93572",
    "CVE-2026-93573",
    "CVE-2026-93574",
    "CVE-2026-93575",
    "CVE-2026-93576",
    "CVE-2026-93578",
    "CVE-2026-93579"
  );

  script_name(english:"Oracle Database Server (October 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as
referenced in the October 2026 CPU advisory.

  - Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server. Supported versions that are
    affected are 19.3-19.32 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated
    attacker with network access via TLS to compromise RDBMS (OpenSSL). Successful attacks of this
    vulnerability can result in takeover of RDBMS (OpenSSL). (CVE-2026-14456, CVE-2026-14457, CVE-2026-18798,
    CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803)

  - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are
    23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR
    privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability
    can result in takeover of RDBMS. (CVE-2026-91499)

  - Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected
    are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged
    attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP. Successful
    attacks of this vulnerability can result in takeover of Oracle OLAP. (CVE-2026-91563)

  - Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server. Supported versions that are
    affected are 19.3-19.32 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated
    attacker with network access via HTTP to compromise RDBMS (Micronaut). Successful attacks of this
    vulnerability can result in unauthorized creation, deletion or modification access to critical data or all
    RDBMS (Micronaut) accessible data as well as unauthorized read access to a subset of RDBMS (Micronaut)
    accessible data. (CVE-2026-89044, CVE-2026-93492, CVE-2026-93493, CVE-2026-93494, CVE-2026-93560,
    CVE-2026-93561, CVE-2026-93563, CVE-2026-93564, CVE-2026-93565, CVE-2026-93566, CVE-2026-93567,
    CVE-2026-93568, CVE-2026-93569, CVE-2026-93572, CVE-2026-93573, CVE-2026-93574, CVE-2026-93575,
    CVE-2026-93576, CVE-2026-93578, CVE-2026-93579)

  - Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are
    19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker
    having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of
    this vulnerability can result in unauthorized creation, deletion or modification access to critical data
    or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD
    accessible data. (CVE-2026-91503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuoct2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the October 2026 Oracle Critical Patch Update advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-75803");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-42581");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-11824");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:database_server");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rdbms_query_patch_info.nbin", "oracle_rdbms_patch_info.nbin");

  exit(0);
}

include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_rdbms::get_app_info();

var constraints = [
  # RDBMS:
  {'min_version': '23.0', 'fixed_version': '23.26.4.0.0', 'missing_patch':'40002013', 'os':'unix', 'component':'db'},

  {'min_version': '21.0', 'fixed_version': '21.24.0.0.261020', 'missing_patch':'40017330', 'os':'unix', 'component':'db'},
  {'min_version': '21.0', 'fixed_version': '21.24.0.0.261020', 'missing_patch':'39898811', 'os':'win', 'component':'db'},

  {'min_version': '19.0', 'fixed_version': '19.33.0.0.261020', 'missing_patch':'39915792', 'os':'unix', 'component':'db'},
  {'min_version': '19.0', 'fixed_version': '19.33.0.0.261020', 'missing_patch':'39898799', 'os':'win', 'component':'db'},

  # OJVM:
  {'min_version': '19.0', 'fixed_version': '19.33.0.0.261020', 'missing_patch':'39803650', 'os':'win', 'component':'ojvm'},
  {'min_version': '19.0', 'fixed_version': '19.33.0.0.261020', 'missing_patch':'39803650', 'os':'unix', 'component':'ojvm'}

];

vcf::oracle_rdbms::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);