Oracle ORDS CVE-2026-101384

Exploitation requires network HTTP reachability to an Oracle REST Data Services Core endpoint and a valid low-privilege account on the target (CVSS PR:L) - it is NOT exploitable by a fully unauthenticated attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The impact is limited to unauthorized read access to a subset of ORDS-accessible data (C:L), with the scope change (S:C) meaning disclosed data may extend to additional products integrated with ORDS. Affected deployments are ORDS versions 24.2.0 through 26.1.0; environments on patched/other versions or that do not expose ORDS over the network to low-privileged users are not at risk. The primary limiting factor is the mandatory low-privilege authentication requirement.

This is a moderate-severity information-disclosure issue (CVSS 3.1 base 5.0) rather than a top-tier emergency. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L - the attacker must already be authenticated at a low level), with no user interaction, yielding only limited confidentiality impact (C:L) and no integrity or availability impact. The scope change (S:C) is the one aggravating factor: Oracle explicitly warns attacks 'may significantly impact additional products,' meaning a compromise of ORDS could expose data belonging to adjacent components. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. There is no SSVC decision data supplied. Signals are therefore consistent and point to a low-to-moderate real-world priority: patch in the normal Oracle Critical Patch Update (October 2026) cycle rather than as an out-of-band emergency. Note a data conflict worth verifying: the input Tags label this 'Authentication Bypass,' but the description and CVSS (PR:L, confidentiality-only read of a data subset) describe a low-privileged information disclosure, not an authentication bypass - treat the tag as suspect.

A low-privileged user who already holds network HTTP access to an Oracle REST Data Services endpoint sends crafted requests that abuse a flaw in the Core component to read a subset of data they should not be able to see. Because the vulnerability carries a scope change, the disclosed data may belong to adjacent products that rely on ORDS. No public proof-of-concept is available, and low attack complexity means a working exploit, once developed, would be reliable.