Oracle ORDS CVE-2026-101368

Exploitation requires human interaction from a person other than the attacker (CVSS UI:R) - a legitimate ORDS user must be induced to interact with attacker-crafted input/link, so this cannot be driven to completion by the attacker alone and is amenable to phishing/social-engineering defenses. The affected component is specifically ORDS Backend-as-a-Service, reachable over HTTP, in versions 24.2.0 through 26.1.0; environments not exposing this component or already patched per the Oracle October 2026 CPU are not affected. No authentication is required of the attacker (PR:N), and impact is limited to a subset of ORDS-accessible data with partial read and partial update/insert/delete, no availability effect.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that does NOT rise to a drop-everything priority. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N shows network reachability and no attacker privileges, but mandatory user interaction (UI:R) and only LOW confidentiality and integrity impact with NO availability impact - meaning an attacker cannot act alone and gains only partial read plus partial update/insert/delete on a subset of ORDS-accessible data. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit is identified, so there is no evidence of active exploitation; this is a vendor-reported (secalert_us@oracle.com) flaw disclosed via the Oracle October 2026 CPU rather than a signal of in-the-wild abuse. The CVSS network vector is consistent with the description's 'network access via HTTP.' One tension to verify: the input Tag labels this 'Authentication Bypass,' yet the description describes unauthenticated-but-user-interaction-dependent unauthorized data access with partial C/I impact - a pattern more typical of CSRF or reflected injection than a true auth bypass; treat the tag as unconfirmed. Overall: a real but second-tier item best handled via normal Oracle CPU patch cycles unless ORDS Backend-as-a-Service is internet-exposed.

An attacker crafts a malicious HTTP link or page targeting an ORDS Backend-as-a-Service endpoint and lures a legitimate user (e.g. via phishing) into visiting it. When the victim interacts, the request executes in their context, letting the attacker read a subset of ORDS-accessible data and perform some unauthorized insert/update/delete operations. No public exploit code is identified at time of analysis, and the required human interaction raises the practical bar.