Oracle REST Data Services CVE-2026-101366

Exploitation requires the attacker to already possess a valid low-privilege authenticated account on Oracle REST Data Services (CVSS PR:L) and network HTTP access to the ADP component; it does not work against unauthenticated outsiders. The affected versions are ORDS 24.2.0 through 26.1.0. Limiting factors: authentication is mandatory, impact is confined to read-only disclosure of a subset of accessible data (no write/integrity or availability effect), and no user interaction is needed. The exact ADP configuration or feature state that must be present is not specified in the advisory, so defenders should confirm whether the ADP component is enabled in their deployment.

This is a moderate-severity information-disclosure issue, not a top-tier priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable, low-complexity attack requiring an already-authenticated low-privileged account, yielding only partial confidentiality loss (C:L) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent except for one conflict: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L requirement (the attacker must already hold valid low-privilege credentials, so this is not an unauthenticated bypass) and the description's own 'low privileged attacker' wording - treat the tag as likely mislabeled rather than evidence of a pre-auth flaw. Net assessment: a real but low-urgency vulnerability best handled in normal Oracle Critical Patch Update cycles rather than as an emergency, given the authentication precondition and limited (read-only, partial) impact.

An attacker who already holds a valid low-privilege Oracle REST Data Services account sends crafted HTTP requests to the ADP component and gains unauthorized read access to a subset of ORDS-accessible data they should not be able to view. No public exploit code was identified in the provided data, and the attack requires network access plus existing authenticated credentials, limiting it to insiders or attackers who have obtained low-level access.