Oracle REST Data Services CVE-2026-101382

Exploitation requires the attacker to already possess a low-privileged authenticated account on the Oracle REST Data Services instance (PR:L) and network HTTP access to the Core component; it is NOT remote-unauthenticated. The CVSS AC:H rating indicates limiting factors beyond the attacker's control - such as specific timing, state, or non-default configuration conditions - that make reliable exploitation difficult. No user interaction is needed (UI:N). Affected deployments are ORDS versions 24.2.0 through 26.1.0; impact is confined to a subset of ORDS-accessible data (partial read plus unauthorized update/insert/delete), with no availability impact.

This is a genuinely low-priority issue despite being network-reachable. The Oracle-assigned CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2 Medium) tells a consistent, low-risk story: exploitation is over HTTP but is 'difficult to exploit' (AC:H), requires the attacker to already hold low-level privileges (PR:L - not unauthenticated), and yields only partial confidentiality and integrity impact (C:L/I:L) with no availability impact. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced - so all three real-world exploitation signals are either absent or negative. The signals do not conflict: a high-complexity, privilege-requiring, partial-impact flaw with no exploitation evidence does not warrant emergency patching and should be handled on a normal Oracle Critical Patch Update cadence. One metadata conflict must be flagged: the 'Authentication Bypass' tag contradicts the description and the PR:L metric, which both indicate an already-authenticated low-privileged attacker rather than any bypass of authentication - treat that tag as suspect and verify against Oracle's CPU October 2026 advisory.

A low-privileged user who already holds valid, limited access to an Oracle REST Data Services instance crafts specific HTTP requests to the Core component to reach data beyond their authorization boundary. Because the CVSS complexity is High, the attacker must satisfy non-trivial preconditions or win a race/configuration-dependent condition, after which they gain read access to a subset of data and the ability to update, insert, or delete some accessible data. No public exploit code is referenced, so an attacker would need to develop the technique independently.