Oracle REST Data Services CVE-2026-101493

Exploitation requires the attacker to already hold a valid low-privileged account on the target Oracle REST Data Services instance (PR:L) with network HTTP reachability to the Core component; no user interaction is needed (UI:N). The flaw affects supported versions 24.2.0 through 26.2.1. The main limiting factor is the authenticated-access prerequisite: an attacker must first obtain low-level credentials or a legitimate account, so exposure is greatest in multi-tenant, shared, or internet-facing ORDS deployments where low-privilege accounts are broadly provisioned. Impact is bounded to a subset of accessible data (partial read plus unauthorized insert/update/delete), with no availability impact.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (Medium) reflects a network-exploitable (AV:N), low-complexity (AC:L) flaw that nonetheless requires the attacker to already hold some valid privileges (PR:L) and causes only limited, partial impact to confidentiality and integrity (C:L/I:L) with no availability impact (A:N) and no scope change (S:U). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - all three exploitation-probability signals are absent rather than low, which is itself a data gap. The practical effect is that an already-authenticated, low-privileged user of an Oracle REST Data Services instance could gain unauthorized read access to a subset of data and unauthorized update/insert/delete access to some data - a horizontal/vertical authorization weakness rather than a pre-auth remote takeover. Note a conflict in the metadata: the input carries an 'Authentication Bypass' tag, yet the CVSS vector is PR:L and the description explicitly requires a 'low privileged attacker,' which is inconsistent with a true authentication bypass - verify the classification with Oracle's advisory. Overall, prioritize patching for internet-facing ORDS instances and multi-tenant deployments, but this does not warrant the same urgency as an unauthenticated RCE.

An attacker who already possesses a low-privileged account on an Oracle REST Data Services deployment sends crafted HTTP requests to the Core component, abusing insufficient authorization checks to read data they should not see and to insert, update, or delete a subset of records. Because the vector is network-based with low complexity (AV:N/AC:L) and needs no user interaction, exploitation is straightforward once valid low-level credentials exist, though no public exploit code was identified in the provided intelligence.