Oracle REST Data Services CVE-2026-101375

Exploitation requires the attacker to hold a valid low-privileged authenticated session (CVSS PR:L) to the Oracle REST Data Services Database Actions component, reachable over HTTP (AV:N). No victim user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factors are: (1) the attacker must already possess credentials or an authenticated foothold with at least low privileges in ORDS - purely unauthenticated anonymous exploitation is not supported by the vector; and (2) the Database Actions component must be network-exposed and enabled. Impact is bounded to partial access (C:L/I:L/A:L) within a subset of ORDS-accessible data, not full database compromise.

This is a moderate-severity, authenticated vulnerability best characterized as a genuine-but-not-urgent patch priority rather than an emergency. The CVSS 3.1 base score is 6.3 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L: network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L) and yielding only partial (Low) confidentiality, integrity, and availability impact with no scope change. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent - Oracle's own description ('Easily exploitable... low privileged attacker with network access via HTTP') aligns cleanly with AV:N/AC:L/PR:L, so there is no network-vs-local contradiction to flag. The main limiting factor is the PR:L requirement: an attacker must already hold some authenticated, low-privileged access to Database Actions, which bounds real-world risk and points toward opportunistic or insider abuse rather than mass unauthenticated exploitation. Missing EPSS/SSVC data means the real-world exploitation likelihood is unconfirmed and should be treated as unknown rather than low.

A low-privileged user who already has authenticated HTTP access to the Database Actions component of Oracle REST Data Services sends crafted requests that exceed their authorization boundary, gaining limited read access to some ORDS-accessible data and the ability to insert, update, or delete a subset of it, and to partially degrade the service. No public exploit code is referenced, and no user interaction by a victim is required.