Oracle ORDS CVE-2026-101371

Exploitation requires the attacker to already hold high privileges on the Oracle REST Data Services instance (PR:H) and to reach it over the network via HTTP. Crucially, a successful attack also requires human interaction from a person other than the attacker (UI:R) - a separate victim must be induced to act - and the condition is difficult to win (AC:H), implying a race condition, timing dependency, or non-deterministic precondition rather than a simple request. These combined requirements (prior high privilege plus a second human participant plus high complexity) sharply limit realistic exploitation; impact is further bounded to partial read and partial update/insert/delete access to only a subset of ORDS-accessible data, with no availability impact. Applies to ORDS Core in supported versions 24.2.0 through 26.1.0.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score of 3.1 (Low) is corroborated across every available signal rather than contradicted by them. The vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) shows that although the attack vector is network/HTTP, exploitation is gated by three independent mitigating factors simultaneously: high attack complexity (AC:H), the need for pre-existing high privileges (PR:H), and required interaction from a victim other than the attacker (UI:R). The impact is likewise limited - only partial (Low) confidentiality and integrity impact, no availability impact, and no scope change. No EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the input, so there is no public exploit identified at time of analysis. There is no signal conflict to reconcile: a high-privileged, high-complexity, user-interaction-dependent flaw with only partial C/I impact is a low real-world risk, not a high-CVSS-but-overrated case. One data caveat: the input Tags include 'Authentication Bypass,' which directly contradicts the PR:H requirement in both the Oracle description and the CVSS vector - treat that tag as suspect, as this vulnerability requires an already-authenticated high-privileged actor rather than bypassing authentication.

An attacker who already holds high-privileged access to an Oracle REST Data Services instance crafts a malicious HTTP interaction and lures a separate privileged user into triggering it, exploiting a difficult-to-win condition to gain limited unauthorized read, update, insert, or delete access to a subset of ORDS-accessible data. No public exploit code is identified at time of analysis, and the high complexity plus required victim interaction make opportunistic exploitation unlikely.