Oracle REST Data Services CVE-2026-35277

Attacker must have network reachability to the Oracle REST Data Services HTTPS listener and must hold a low-privileged ORDS-recognised credential (CVSS PR:L), but no user interaction is required and attack complexity is low. The vulnerable component is the ORDS Core, so only deployments running ORDS versions 24.2.0 through 26.1.0 are affected; deployments that do not expose ORDS to the network or that restrict it to administrative VLANs materially limit reach. Scope is unchanged (S:U) and impact is confined to data the ORDS instance can access, so the blast radius depends on which database schemas the affected ORDS tier has been granted.

Risk is meaningful but not immediate-emergency. The CVSS 3.1 score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates a network-exploitable, low-complexity issue requiring only low-privilege credentials and no user interaction, with high confidentiality and integrity impact but no availability impact - typical of an authorization-bypass or broken-access-control issue against a database-fronting REST tier. There is no EPSS score, KEV listing, or public POC in the supplied intelligence, so widespread opportunistic exploitation is not currently signalled; however, ORDS endpoints are frequently internet-exposed and credentials for low-privileged ORDS/APEX accounts are common, so an attacker with any valid ORDS account (or one obtainable via self-registration in some APEX deployments) could weaponize this against high-value databases. The 'Authentication Bypass' tag is in mild tension with the CVSS PR:L (which requires some privileges) - verify with Oracle whether the bypass elevates an unprivileged account or fully removes authentication.

An attacker who has obtained or registered any low-privileged ORDS account (for example, a basic APEX end-user) sends crafted HTTPS requests to the ORDS Core endpoints and bypasses the authorization layer to read or modify data belonging to other schemas or higher-privileged users. With no public exploit identified at time of analysis, the realistic near-term threat is targeted abuse by insiders or attackers who have already harvested ORDS credentials rather than mass exploitation.