Oracle ORDS CVE-2026-101379

No special configuration conditions are stated in the Oracle description: exploitation requires only network HTTP access to an Oracle REST Data Services instance running an affected version (24.2.0 through 26.1.0) with the ADP component reachable, against which an unauthenticated attacker (PR:N) can act without user interaction. The principal limiting factors are therefore network reachability of the ORDS endpoint (internal-only deployments behind a proxy/VPN are far less exposed than internet-facing ones) and running an affected version; impact is also inherently bounded to read access to a subset of data (no write/modify or service disruption), which caps the realistic damage.

This is a medium-severity (CVSS 3.1 base 5.3) information-disclosure flaw in Oracle REST Data Services (ORDS), component ADP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent and credible: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction, with impact limited to low confidentiality (unauthorized read access to a subset of data) and no integrity or availability impact. Oracle's own text ('easily exploitable, unauthenticated attacker with network access') aligns with the PR:N/AC:L metrics, so there is no vector-vs-description conflict here. However, the key exploitation-maturity signals are absent: no EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis. The practical consequence is that while the issue is trivially reachable in principle, its limited (partial-confidentiality-only) impact and lack of known exploitation make it a moderate, patch-in-normal-cycle priority rather than an emergency, EXCEPT for internet-exposed ORDS endpoints where unauthenticated data leakage warrants faster remediation. Note: SSVC/automatable and technical-impact fields were not supplied in the input, so that framework could not be applied - assessment rests on CVSS plus the Oracle description only.

An unauthenticated attacker who can reach an ORDS HTTP endpoint sends a crafted request to the ADP component and receives back a subset of data it should not be able to read, without needing credentials or user interaction. No public exploit code was identified at time of analysis, so this reflects the capability implied by the CVSS vector rather than an observed in-the-wild technique.