EIP-2026-117729

This is a writeup detailing an unquoted service path vulnerability in Oracle Database 11g Release 2. The vulnerability allows local privilege escalation if an attacker can place an executable in a path that the service searches for, due to improper quoting of the service path.