Oracle ORDS CVE-2026-101378

Exploitation requires the attacker to already possess a valid low-privilege account on the target Oracle REST Data Services instance (CVSS PR:L) and network HTTP reachability to the ADP component. No user interaction is needed (UI:N) and complexity is low (AC:L), but the mandatory authentication is the key limiting factor: this cannot be exploited by a fully unauthenticated attacker despite the 'Authentication Bypass' tag. Impact is confined to unauthorized insert/update/delete against a subset of ORDS-accessible data (partial integrity, I:L) with no confidentiality or availability effect; affected versions are ORDS 24.2.0 through 26.1.0.

This is a genuine but low-to-moderate priority issue, not an urgent emergency. The CVSS 3.1 base score is 4.3 (Medium), and the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) tells a consistent story: network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L) and yielding only a limited integrity impact (I:L) with no confidentiality or availability loss. No EPSS score is provided, there is no CISA KEV listing, and no public exploit (POC) is available, so all exploitation signals point to no demonstrated or probable real-world exploitation at this time. There is a notable conflict in the input metadata: the 'Authentication Bypass' tag contradicts both the CVSS PR:L metric and the description's own wording ('low privileged attacker'), which require an attacker to already hold valid low-privilege credentials rather than bypass authentication - this tag appears mislabeled and should not be used to escalate perceived severity. Overall this reads as a high-reach-but-low-impact flaw: broadly network-accessible but gated behind authentication and limited to partial data tampering.

An attacker who already holds a low-privileged ORDS account sends crafted HTTP requests to the Oracle REST Data Services ADP component and performs unauthorized update, insert, or delete operations against a subset of ORDS-accessible data. No public exploit code is available, and the attack requires valid (if minimal) credentials, so this is more plausible as an insider or post-credential-compromise action than mass internet exploitation.