EUVD-2026-105792
GHSA-5q4m-jxr2-c286
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged ORDS access
-
ExploitSend crafted HTTP request to Database Actions
-
ExecutionAbuse component logic
-
ImpactRead/modify subset of data and cause partial DOS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Database Actions component of Oracle REST Data Services and requires the attacker to already hold HIGH privileges on the ORDS instance (PR:H) reachable over HTTP - this authentication/privilege level is the primary limiting factor. Affected deployments run ORDS versions 24.2.0 through 26.1.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), but because high privileges are a prerequisite, exposure is effectively limited to environments where a potentially malicious or compromised privileged account can reach the Database Actions HTTP endpoint; default unauthenticated internet exposure does not by itself enable this attack. |
| Impact | This is a moderate-severity issue (CVSS 3.1 base 4.7) that is unlikely to be a top patching priority despite its network vector. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) is the strongest limiting factor: although exploitation is over the network with low attack complexity and no user interaction, it requires PR:H - high privileges already held on the target Oracle REST Data Services instance. An attacker who already has high privileges can do far more damage through legitimate channels, which sharply reduces real-world urgency. All impacts are rated Low (partial read of a data subset, partial update/insert/delete of some data, and partial DOS), so this is not a full-compromise flaw. No EPSS score, CISA KEV listing, or public POC is present in the provided data: there is no evidence of active exploitation or available exploit code. The 'easily exploitable' wording in Oracle's description refers to AC:L and should not be read as 'unauthenticated' - it is contradicted by the PR:H requirement, so the practical exploitability is gated by the attacker first obtaining high privileges. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privileged access to an Oracle REST Data Services deployment sends crafted HTTP requests to the Database Actions component to read a subset of accessible data and perform unauthorized updates, inserts, or deletes, and can partially degrade the service. No public exploit code was identified in the provided data, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 expose an access-control weakness in the Database Actions component that lets an attacker who already holds high privileges on the ORDS instance reach it over HTTP and perform unauthorized reads, inserts, updates and deletes against a subset of ORDS-accessible data, while also degrading availability enough to cause a partial denial of service. Because the vector is PR:H with UI:N and AC:L (CVSS 3.1 base 4.7), the practical barrier is not exploitation difficulty but the requirement for an already-privileged account that can touch the Database Actions endpoint; unauthenticated internet exposure alone does not enable the attack. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so this is a moderate-severity integrity/confidentiality issue for privileged-account compromise and insider-risk scenarios rather than an urgent perimeter emergency.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix covering Oracle REST Data Services 24.2.0 through 26.1.0; patch status is 'Patch available per vendor advisory' - no standalone fix version number is confirmed in the supplied data, so take the ORDS build named in that CPU rather than assuming an increment. Until patched, reduce the attack surface: restrict network access to the Database Actions web endpoints (the ORDS servlet paths serving the SQL/browser console) to trusted administrator networks via firewall or reverse-proxy allow-lists - trade-off is loss of remote developer access unless VPN/jump-host access is provided; disable Database Actions entirely where it is not used by removing or unmapping its servlet in web.xml or by disabling the feature in the ORDS configuration and restarting ORDS - trade-off is that developers lose the web SQL console and must use SQLcl/SQL*Plus or APEX; and enforce least privilege off the back of the PR:H precondition by auditing and reducing which accounts hold high ORDS privileges, rotating credentials, and alerting on privileged Database Actions sessions that perform bulk DML or cause availability degradation - trade-off is administrative overhead and possible false positives during legitimate bulk operations. Given the high-privilege prerequisite and partial-availability impact, schedule the patch on a normal cycle rather than emergency basis, but prioritize it wherever shared or weakly governed privileged accounts can reach the console.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based mid-tier that publishes Oracle Database schemas, PL/SQL and SQL as RESTful endpoints, and it ships Database Actions (formerly SQL Developer Web), a browser-delivered console for running SQL, browsing objects and administering schemas through those same HTTP handlers. The flaw sits in the authorization logic of the Database Actions component: the service does not sufficiently constrain what an already highly privileged ORDS user can do through that surface, so the privilege boundary that should separate administrative console actions from data-plane operations is not enforced as intended. No CWE was assigned, but the behavior is consistent with an authorization/access-control class issue (improper privilege enforcement) rather than memory corruption or injection - the CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L describes a same-scope impact where a high-privileged network actor obtains low-level confidentiality, integrity and availability effects: reading a subset of ORDS-accessible data, unauthorized update/insert/delete on some of that data, and partial denial of service. The CPE/version data supplied (EUVD: Oracle REST Data Services 24.2.0 ≤ 26.1.0) confines exposure to current 24.x/25.x/26.x releases; older ORDS generations are outside the stated range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Network HTTP vector with low complexity, but the description's 'high privileged attacker' forces PR:H; impacts are all partial, so C/I/A are each Low.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB