Oracle REST Data Services CVE-2026-101363

Requires an Oracle REST Data Services deployment (versions 24.2.0 through 26.1.0) with the GraphQL component reachable over HTTP from the attacker's network position. No authentication, credentials, or user interaction are needed (PR:N/UI:N). Limiting factors: the GraphQL endpoint/component must be exposed and in use, and the disclosure is confined to a subset of ORDS-accessible data (C:L) with no write or denial-of-service capability, which meaningfully caps real-world impact.

This is a moderate-severity information disclosure flaw (CVSS 3.1 base 5.3) in Oracle REST Data Services' GraphQL component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) signals the most concerning combination for reach - network-based, low-complexity, unauthenticated, no user interaction - so the barrier to attempt is genuinely low. However, impact is tightly bounded: C:L with I:N/A:N means only a subset of ORDS-accessible data is readable, with no integrity or availability effect and no scope change (S:U). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The net picture is a real but limited-priority issue: easy to reach but low-consequence, typical of the Oracle Critical Patch Update info-disclosure class. Patch during the normal CPU cycle rather than as an emergency, unless the affected ORDS instance fronts sensitive data. Note a labeling tension: the input tags this 'Authentication Bypass,' but the metrics and description describe unauthorized read of a data subset (an information disclosure), not a full authentication bypass - treat the tag with caution.

An unauthenticated attacker with network HTTP access to an ORDS instance exposing the GraphQL component sends crafted GraphQL queries to the endpoint and retrieves a subset of data they should not be able to read. No credentials, user interaction, or special timing are required, but the disclosure is limited to a subset of ORDS-accessible data. No public exploit code was identified in the provided intelligence.