Oracle REST Data Services CVE-2026-46775

Attacker must reach the ORDS HTTPS listener (typically TCP 8443 or behind a reverse proxy on 443) and hold any low-privileged ORDS-recognized credential (PR:L per CVSS) - this includes self-registered APEX users, REST-enabled schema accounts, or any application user mapped through ORDS authentication. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: ORDS instances not exposed to untrusted networks and deployments that disallow self-registration or guest/anonymous account creation materially reduce the attacker population; deployments running versions below 24.2.0 or any future patched release from the May 2026 Oracle CPU are not in scope.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS vector AV:N/AC:L/PR:L/UI:N is a near-worst-case profile for an internet-facing data API: any account with minimal ORDS privileges (which in many deployments includes self-registered or default users) can fully compromise the service over the network with no user interaction. The S:C scope change combined with C:H/I:H/A:H means a successful attack does not just affect ORDS but pivots into the backend database - exactly the cross-system impact defenders most fear with database REST gateways. EPSS and CISA KEV data were not provided in the input, so widespread exploitation cannot be confirmed; absence of evidence is not evidence of absence, particularly for a newly disclosed CPU vulnerability. No public exploit identified at time of analysis, but Oracle's own characterization of 'easily exploitable' combined with ORDS's typical exposure on the internet perimeter makes this a strong candidate for rapid weaponization once the patch is reverse-engineered.

An attacker obtains or registers a low-privileged ORDS account (for example via a self-service APEX workspace or a compromised application user) and sends a crafted HTTPS request to an ORDS endpoint that triggers the Core component flaw, escalating privileges within ORDS and pivoting through the scope change into the backing Oracle Database. The result is full takeover of ORDS plus read/write access to database objects the ORDS runtime can reach. No public exploit identified at time of analysis, but the 9.9 score and 'easily exploitable' wording in Oracle's advisory suggest exploitation is straightforward once the vulnerable code path is identified.