Oracle ORDS CVE-2026-101380

Exploitation requires the attacker to already hold a low-privileged account on Oracle REST Data Services (PR:L) and to reach the ADP component over HTTP (AV:N). Successful attack additionally REQUIRES human interaction from a different person (UI:R) - a victim must view or act on attacker-supplied content - so it cannot be triggered unattended. The scope change (S:C) means impact can extend to additional products beyond ORDS. Limiting factors: valid authentication, mandatory third-party user interaction, and the affected version window 24.2.0-26.1.0; impact is partial (C:L/I:L) with no availability effect (A:N).

This is a medium-severity, authenticated, user-interaction-dependent vulnerability that should be treated as a routine-to-moderate patch priority rather than an emergency. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a low-privileged attacker over HTTP who needs a separate victim to interact, yielding partial confidentiality and integrity impact with a scope change to other products - a profile strongly consistent with a stored/reflected cross-site scripting or injection issue, NOT the 'Authentication Bypass' implied by the input tag (see data_quality_flags). No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of exploitation pressure - no public exploit identified at time of analysis. The requirement for both valid low-level privileges (PR:L) and human interaction from a third party (UI:R) materially lowers real-world risk versus the raw network attack vector, since an attacker cannot act fully unauthenticated or unattended. Net: a genuine but non-critical issue - apply the October 2026 Oracle CPU fix on a normal cycle; the absence of availability impact (A:N) and lack of full system compromise argue against treating it as a drop-everything item.

An attacker holding a low-privileged Oracle REST Data Services account submits crafted input (e.g., a malicious payload stored or reflected through the ADP component) and lures a higher-value user into viewing it over HTTP. When that victim interacts with the content, the payload executes in their context, allowing limited unauthorized read of some data and unauthorized insert/update/delete of other data, with effects crossing into additional connected products due to the scope change. No public exploit code is identified at time of analysis.