EUVD-2026-105793
GHSA-rpgq-mgff-2vqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege ORDS access
-
ExploitSend crafted HTTP request to Database Actions
-
ImpactTrigger partial availability disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker who already possesses HIGH privileges within Oracle REST Data Services (PR:H) and network HTTP access to the Database Actions component; the flaw is reached by crafted HTTP requests against that component. The limiting factors are significant: the attacker must already be a privileged ORDS/database operator, no user interaction is needed (UI:N), and the only achievable impact is a PARTIAL denial of service of ORDS (A:L) - there is no confidentiality or integrity impact. Affected deployments are Oracle REST Data Services versions 24.2.0 through 26.1.0. |
| Impact | This is a low-priority, high-CVSS-does-NOT-apply situation - the CVSS 3.1 base score is only 2.7 (LOW), so there is no severity inflation to deflate here. The vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) shows network reach and low attack complexity, but it is gated by PR:H (high privileges already required) and limited to a PARTIAL availability impact with no confidentiality or integrity effect. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so all exploitation signals point the same direction: this is a minor, authenticated denial-of-service weakness, not an urgent threat. The one caveat is the wording mismatch - Oracle labels it 'easily exploitable' (reflected as AC:L) yet simultaneously requires a HIGH-privileged attacker, meaning the 'ease' only applies to someone who is already a privileged database/ORDS operator; that combination makes real-world risk low. No signals conflict in a way that raises severity; if anything, the high privilege requirement further reduces practical risk. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege credentials for Oracle REST Data Services sends crafted HTTP requests to the Database Actions component to trigger a partial denial of service, degrading or interrupting ORDS availability. No public exploit code has been identified, and the attack yields only a partial DoS with no data compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A partial denial of service can be triggered in Oracle REST Data Services 24.2.0 through 26.1.0 through the Database Actions component, but only by an attacker who already holds high privileges within ORDS and can reach it over HTTP. The weakness is easily exploitable in terms of attack complexity (AC:L, no user interaction) yet the ceiling is availability-only and partial (A:L), with no confidentiality or integrity impact, yielding a CVSS 3.1 score of 2.7. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in the October 2026 CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; Oracle CPU advisories for ORDS typically direct customers to the latest supported ORDS release, so upgrade to the ORDS version named in that advisory (or later) and verify the Database Actions component is updated in every deployment, including standalone and WebLogic/Tomcat-hosted instances. Vendor-released patch: consult the CPU advisory for the exact patched ORDS build, as no specific fix version number is provided in the available data. Because exploitation requires high privileges, the highest-value compensating controls are credential hygiene and least privilege: restrict Database Actions access to administrators who genuinely need it, disable or unmask the Database Actions endpoints (ORDS configuration such as disabling the Database Actions/DAD feature) on internet-facing or untrusted deployments at the cost of losing the browser-based tooling, and front ORDS with a reverse proxy or access-control list limiting /ords/.../db-actions style paths to trusted management networks or VPN. Enforce strong authentication and monitor privileged ORDS accounts for anomalous request patterns, since abuse of a compromised admin account is the realistic exploitation path; none of these controls removes the underlying flaw, so patching remains required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based middleware layer that publishes Oracle Database schemas as RESTful endpoints; Database Actions is the bundled web-based tooling (SQL, Data Load, REST workshop, etc.) exposed through ORDS over HTTP. The flaw resides in that HTTP-facing Database Actions surface and falls into availability-impact class weaknesses, where a crafted request from an already-privileged operator degrades service responsiveness rather than exposing or altering data. Because the CVSS vector is unchanged-scope (S:U) with PR:H, exploitation does not cross a privilege boundary: the attacker must already be a privileged ORDS/Database Actions user, which sharply limits the realistic threat population to trusted administrators or accounts whose credentials have been compromised. EUVD corroborates the affected range (24.2.0 to 26.1.0), and no CWE was assigned in the supplied data, so the root-cause class is inferred from the vector rather than a formal weakness taxonomy.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Network HTTP reach (AV:N) with low complexity, but requires existing high privileges (PR:H); only a partial availability impact (A:L) with no C or I effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB