Oracle REST Data Services CVE-2026-35266

Exploitation requires (1) the attacker to hold a low-privileged authenticated ORDS account or otherwise reach an authenticated ORDS endpoint over HTTPS (PR:L), (2) a separate victim user with higher privileges to perform an interaction such as clicking a crafted URL or loading attacker-controlled content while logged into ORDS (UI:R), and (3) the target instance to be running an affected ORDS release in the 24.2.0-26.1.0 range with the Core request-handling path reachable. Attack complexity is explicitly High (AC:H), meaning the attacker must overcome conditions outside their control - likely timing, session state, or specific configuration of REST-enabled schemas - making reliable exploitation non-trivial; instances without authenticated low-privileged user provisioning, or where ORDS admin/authoring UIs are unreachable from the attacker's network position, are not realistically exploitable.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L yields 7.9 (High) - network-reachable but explicitly High attack complexity, requiring both low-privileged authentication AND user interaction from a separate victim, which materially constrains opportunistic exploitation. The Scope:Changed and dual High C/I impacts are the aggravating factors: a successful exploit reaches data and components beyond ORDS itself, which is why the score remains High despite the AC:H/UI:R brakes. No EPSS score, KEV listing, or POC was supplied in the intelligence set, so real-world exploitation probability is currently unmeasured rather than confirmed low - typical for a fresh Oracle CPU disclosure. Net: this is a real priority for any internet- or partner-exposed ORDS deployment because of the scope change, but the AC:H + UI:R combination makes mass exploitation unlikely; targeted abuse against high-value Oracle Database back-ends is the more realistic threat model.

An attacker with a low-privileged ORDS account (for example, a developer schema or a delegated REST-enabled user) crafts a malicious link or REST request and lures a higher-privileged ORDS user - such as an admin reviewing a shared module or a logged-in DBA - into clicking or rendering it; the request abuses the Core component's session handling to perform write or read operations under the victim's elevated context. Because scope is changed, the resulting actions can reach Oracle Database objects beyond what ORDS itself owns, enabling data theft or modification across linked schemas. No public exploit identified at time of analysis, so this scenario is constructed from the CVSS vector and component description rather than observed tradecraft.