Oracle ORDS CVE-2026-101374

Exploitation targets the Oracle REST Data Services Backend-as-a-Service component over HTTP and requires no authentication (PR:N) and no user interaction (UI:N), but is explicitly rated 'difficult to exploit' (AC:H) - meaning success depends on specific conditions outside the attacker's control, such as particular request timing, backend data state, or environmental factors that Oracle has not detailed. The primary limiting factors are the High attack complexity and the fact that only ORDS versions 24.2.0 through 26.1.0 are affected; the attack also requires an ORDS instance to be network-reachable on its HTTP interface, so instances not exposed beyond trusted networks face substantially reduced risk. Impact is confined to data integrity (create/delete/modify), with no data disclosure or service disruption.

This is a moderate-risk, not top-priority, vulnerability despite affecting an internet-facing component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 5.9) shows a conflicting risk profile: it is network-reachable and requires no authentication (PR:N) or user interaction (UI:N), which raises exposure, but attack complexity is High (AC:H), meaning successful exploitation depends on conditions outside the attacker's control (e.g., winning a race, specific data state, or non-trivial preconditions) - Oracle's own description explicitly calls it 'difficult to exploit.' Impact is narrow: integrity only (I:H), with no confidentiality (C:N) or availability (C:N/A:N) impact, so an attacker can create, delete, or modify data but cannot read it or take the service down. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or weaponization - no public exploit identified at time of analysis. The AC:H rating combined with absence of KEV/EPSS/POC signals strongly suggests this is a high-CVSS-reachability but low-real-world-likelihood issue rather than a drop-everything emergency. Note: the 'Authentication Bypass' tag is not supported by the description, which describes an integrity compromise by an already-unauthenticated attacker, not a bypass of an auth control - verify intended classification with Oracle's October 2026 CPU.

An unauthenticated attacker with network access sends a specially crafted HTTP request to an exposed Oracle REST Data Services endpoint and, by satisfying a difficult-to-achieve precondition (AC:H), manipulates backend data to create, alter, or delete records in Oracle REST Data Services-accessible data. Because confidentiality is not impacted, the goal is tampering or sabotage rather than data theft. No public exploit code was identified, and the high attack complexity means real-world exploitation requires significant effort or favorable timing.