Oracle ORDS CVE-2026-101385

Exploitation requires the attacker to already possess high privileges on the target Oracle REST Data Services instance (PR:H) and network reachability to its HTTP interface; there is no authentication-bypass or unauthenticated path per the confirmed CVSS vector. No user interaction is required and attack complexity is low, so a privileged attacker faces few technical hurdles, but the high-privilege prerequisite is the key limiting factor that confines realistic exploitation to malicious insiders or attackers who have already compromised a privileged ORDS account. Only ORDS versions 24.2.0 through 26.1.0 are affected; impact is limited to data integrity with no confidentiality or availability consequences.

This is a moderate-severity integrity flaw (CVSS 3.1 base 4.9) in Oracle REST Data Services, and the signals converge on it being a lower-priority issue rather than an emergency. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) tells a consistent story: although the attack is over the network via HTTP with low complexity and no user interaction, it requires PR:H - the attacker must already hold high privileges on the ORDS instance - which sharply limits the realistic attacker population to insiders or already-compromised admin accounts. Impact is confined to integrity (I:H): unauthorized creation, deletion, or modification of ORDS-accessible data, with no confidentiality (C:N) or availability (A:N) impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or likely imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' One conflict is worth flagging: the input carries an 'Authentication Bypass' tag, but the CVSS vector explicitly requires PR:H (an already-authenticated, highly privileged attacker), which contradicts a genuine authentication-bypass characterization - verify the technique classification with Oracle. Overall this is a 'patch in normal cycle' item, not a drop-everything priority.

An attacker who already holds high-privilege access to an Oracle REST Data Services instance (for example a rogue administrator or an attacker who has pivoted into an admin session) sends crafted HTTP requests to the ORDS Core component to create, alter, or delete data they should not be able to tamper with. No user interaction is needed and attack complexity is low, but because PR:H is required the attack cannot be launched by an unprivileged or anonymous remote user. No public exploit code was identified at the time of analysis.