EUVD-2026-105783
GHSA-5pp7-7g97-vr8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege ORDS credentials
-
ExploitSend crafted HTTP request to ADP component
-
ExecutionBypass authorization on ORDS-accessible data
-
ImpactRead subset and update/insert/delete some data
Vulnerability Assessment
| Exploitation Conditions | Requires network access over HTTP to an exposed Oracle REST Data Services instance and a low-privilege authenticated identity on ORDS (PR:L) targeting the ADP component; affected only on versions 24.2.0 through 26.1.0. No user interaction is needed (UI:N) and complexity is low (AC:L). LIMITING FACTORS: exploitation is gated by needing valid low-level credentials/session on ORDS (not pre-auth as the 'Authentication Bypass' tag suggests), impact is confined to a subset of ORDS-accessible data with no availability effect, and instances not network-exposed or already upgraded past 26.1.0 are not reachable. |
| Impact | This is a moderate-severity issue (CVSS 3.1 base 5.4) that should be patched in Oracle's normal CPU cadence rather than treated as an emergency. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates a network-reachable, low-complexity flaw requiring low privileges (PR:L) - so an attacker already needs an authenticated, low-privilege foothold on the ORDS instance. Impact is partial: limited read (C:L) plus limited write/update/delete (I:L) to a subset of ORDS-accessible data, with no availability impact (A:N) and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploitation signal - this is no public exploit identified at time of analysis. CONFLICT TO RESOLVE: the input Tags include 'Authentication Bypass', but the Oracle description and CVSS vector both require a 'low privileged attacker' (PR:L), which directly contradicts an authentication bypass - verify with Oracle before treating this as pre-auth. Net: a real but mid-tier priority - the required privileges and partial impact keep real-world risk below what the CRITICAL-adjacent 'Authentication Bypass' tag would imply. |
| Exploit ScenarioDerived | An attacker holding low-privilege authenticated access to an ORDS endpoint sends crafted HTTP requests to the ADP component over the network, requiring no user interaction or special complexity. This lets them read a subset of ORDS-accessible data and perform unauthorized update, insert, or delete operations on some data. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an access-control weakness in the ADP component that lets a low-privileged, authenticated ORDS user reach data they should not control over HTTP, resulting in unauthorized read plus insert/update/delete operations against a subset of ORDS-accessible data (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid low-privilege identity on the ORDS instance - a point worth stressing because the third-party 'Authentication Bypass' tag implies a pre-auth condition, which the assessed vector and Oracle's own description (low-privileged attacker, PR:L) do not support. There is no availability impact, no public exploit identified at time of analysis, no CISA KEV listing, and EPSS data was not provided; Oracle addresses the issue through its standard Critical Patch Update for October 2026, so this should be handled in the normal CPU cadence rather than as an emergency.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor's stated fix path for this CVE; upgrade ORDS to the release identified in that advisory as the corrected version, since no exact fix version number is published in the available data and none should be assumed. Patch available per vendor advisory - schedule it in the normal CPU cadence given the moderate 5.4 score and absence of public exploit code, but do not defer it indefinitely on internet-facing instances. Where an immediate upgrade is impractical, mitigations that reduce real risk: restrict HTTP access to the ORDS listener and to the ADP-related endpoints using network ACLs, reverse-proxy allowlists or WAF rules so only known client networks reach them (trade-off: breaks legitimate external API consumers and requires an accurate endpoint inventory); audit and trim ORDS/APEX user accounts, database roles and REST-enabled schema privileges so that no identity holds more than its task requires (trade-off: re-permissioning work and possible disruption of existing integrations); enable database auditing and ORDS/HTTP access logging on the ADP endpoints to detect anomalous read or DML activity from low-privilege sessions (trade-off: log volume and storage cost, with detection rather than prevention); and for internal-only deployments confirm the service is not inadvertently internet-reachable, since the entire attack path assumes network access to the HTTP endpoint. Revoking broad grants does not remove the underlying flaw - only the CPU does - so treat these as temporary compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based middleware layer (the successor to the APEX Listener) that publishes Oracle Database objects as RESTful HTTP endpoints, handling authentication, connection pooling, PL/SQL gateway calls and JSON serialization. Because it sits in front of the database, a flaw in any of its internal components is effectively a flaw in the database's HTTP attack surface: whatever a caller can persuade ORDS to execute runs with the privileges ORDS maps to that caller's session. Here the affected component is labelled 'ADP' by Oracle and the vulnerability lies in the authorization logic rather than in memory safety - the CVSS profile (AC:L, PR:L, UI:N, S:U, C:L/I:L/A:N) is the classic signature of missing or insufficiently scoped privilege checks on a REST resource, which maps most plausibly to CWE-863 (Incorrect Authorization) or CWE-285 (Improper Authorization); no CWE was assigned in the available data, so this classification is an inference from the impact pattern rather than a vendor statement. The attack path is entirely over standard HTTP(S) against an exposed ORDS listener, requires no user interaction and no special conditions (AC:L), and stays within the same security scope (S:U), meaning the attacker gains only the low-level reach that ORDS already grants their low-privileged identity - but applied to data and operations the identity should not touch. Confidentiality and integrity are each rated Low, consistent with access being confined to a subset of ORDS-accessible data and with no ability to crash or degrade the service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
HTTP network vector (AV:N/AC:L), low-privilege authenticated attacker per the description (PR:L), no user interaction, partial read and write giving C:L/I:L and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB