Oracle REST Data Services CVE-2026-101372

Affects Oracle REST Data Services (Core component) versions 24.2.0 through 26.1.0 exposing an HTTP endpoint reachable by the attacker; no authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is explicitly rated difficult (AC:H in the vendor-supplied vector), meaning success depends on conditions outside the attacker's full control - likely specific request timing, state, or configuration - which substantially limits reliable real-world exploitation. Impact is confined to read-only disclosure of a subset of ORDS-accessible data (C:L), with no integrity or availability effect, so the practical limiting factors are the high complexity and the narrow, partial data exposure.

This is a low-severity issue (CVSS 3.1 base 3.7) and the signals are internally consistent rather than conflicting. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, unauthenticated flaw (PR:N) but one that is explicitly 'difficult to exploit' (AC:H) and yields only partial confidentiality impact (C:L) with no integrity or availability loss. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation. The practical risk is therefore low-to-moderate: the lack of authentication (PR:N) keeps it theoretically internet-exposed, but the high attack complexity and the limited read-only payoff make it an unlikely target for commodity attackers. Note the tension between the 'Authentication Bypass' input tag and the actual description, which characterizes the issue as unauthorized read access to a subset of data rather than a full authentication bypass - treat the tag skeptically and verify scope against Oracle's CPU October 2026 advisory. This is a patch-in-normal-cycle item, not an emergency.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet- or network-reachable Oracle REST Data Services endpoint and, under specific conditions that make the attack difficult to reliably reproduce (AC:H), coaxes the service into returning a subset of data it should not expose. No public exploit code is identified at time of analysis, and the attack yields read-only disclosure with no ability to modify data or disrupt the service.