Oracle ORDS CVE-2026-101361

Exploitation requires the attacker to already possess a low-privileged authenticated account on the Oracle REST Data Services instance (PR:L) and network HTTP access to the Core component (AV:N). The vulnerability is explicitly described as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's sole control - such as winning a race condition or satisfying a specific runtime state - which materially limits reliable exploitation. Affected deployments are limited to ORDS versions 24.2.0 through 26.1.0; no user interaction is required (UI:N). The combination of required authentication plus high complexity is the primary factor constraining real-world risk.

This is a genuinely low-priority vulnerability despite affecting an Oracle enterprise component. The CVSS 3.1 base score is only 4.2 (Medium), and the vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) is self-limiting on multiple axes: high attack complexity (AC:H) means the attacker must win a race, defeat a non-trivial precondition, or control factors outside their direct influence, and low-privilege authentication (PR:L) is required, so this is not an unauthenticated attack. Impact is partial - low confidentiality and low integrity, with no availability impact and no scope change. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept was identified, so all exploitation-likelihood signals are either absent or negative. There is no conflict between signals to flag; rather, every available signal points the same direction (low real-world risk). One data caveat: the input tag 'Authentication Bypass' directly contradicts the CVSS PR:L metric and the description's own 'low privileged attacker' wording - a true authentication bypass would be PR:N, so the tag appears mislabeled and should not drive prioritization. Treat this as a routine patch-in-next-cycle item, not an emergency.

An attacker who already holds a low-privilege authenticated account on an Oracle REST Data Services instance (versions 24.2.0 through 26.1.0) sends crafted HTTP requests over the network to the Core component, winning the difficult preconditions implied by the high attack complexity. On success they gain unauthorized read access to a subset of ORDS-accessible data and can perform limited unauthorized insert, update, or delete operations. No public exploit code was identified at time of analysis, and the high complexity makes reliable exploitation non-trivial.