Oracle REST Data Services CVE-2026-101365

Exploitation requires the attacker to already hold HIGH privileges (administrative/operator-level access) within Oracle REST Data Services, per PR:H - this is the primary limiting factor and rules out unauthenticated or external-only attackers. The attack targets the Database Actions component and is carried out over HTTP (AV:N), with no user interaction (UI:N) and low attack complexity (AC:L) once privileges are held. Only ORDS versions 24.2.0 through 26.1.0 are affected; environments outside this range or without the Database Actions component exposed are not impacted. Impact is bounded to partial read, partial write, and partial DoS of ORDS-accessible data only (scope unchanged, S:U).

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 base score is 4.7 (MEDIUM), and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L reveals the key constraint: PR:H means the attacker must already hold high-privilege (administrative) access to Oracle REST Data Services before exploitation. All three impacts (C:L/I:L/A:L) are only LOW/partial - limited read, limited update/insert/delete, and a partial denial of service rather than full compromise. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit tooling. The 'easily exploitable' wording in Oracle's description aligns with AC:L (low attack complexity) but is heavily offset by the PR:H precondition - a signal worth highlighting because Oracle's 'easily exploitable' phrasing can be misread as low-barrier when it in fact assumes the attacker is already privileged. Net: a defense-in-depth concern (a privileged user escalating their limited reach), not an externally-driven emergency. No conflicting signals were found, but note the absence of EPSS/KEV/POC means exploitation likelihood is inferred, not measured.

An attacker who has already obtained high-privilege credentials for Oracle REST Data Services (e.g., a rogue or compromised admin/operator account) sends crafted HTTP requests to the Database Actions component to read a subset of accessible data, make limited unauthorized modifications (insert/update/delete), or degrade service availability. No public exploit code or active exploitation is identified in the provided data, and the attack cannot be performed by an unauthenticated outsider because high privileges are a prerequisite.