Oracle REST Data Services CVE-2026-46829

The target must be running Oracle REST Data Services 24.2.0-26.1.0 with the Mongoapi (MongoDB API) component enabled and its HTTPS listener reachable from the attacker's network position - Mongoapi is an optional ORDS feature, so deployments that have not enabled the MongoDB API surface are not exposed via this code path. No authentication, user interaction, or elevated privileges are required (PR:N/UI:N/AC:L), and the attack works against default configurations where the Mongoapi feature has been turned on; the only limiting factors are network reachability to the ORDS port and whether Mongoapi is enabled in the deployment.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is unambiguous: network-reachable, no authentication, no user interaction, and high availability impact - which is the textbook profile for a remotely triggerable DoS. EPSS data was not provided in the intelligence feed, and the CVE is not listed in CISA KEV, with no public PoC identified at time of analysis, so this is not currently in the active-exploitation tier. However, ORDS is frequently exposed to the internet as the front door to Oracle Database REST APIs, so a single crafted HTTPS request capable of hanging the service has high operational impact for availability-sensitive deployments; treat as a high-priority patch despite the absence of confidentiality or integrity loss. No conflicting signals were observed in the provided data.

An unauthenticated attacker who can reach the ORDS HTTPS listener identifies the Mongoapi endpoint and sends a single crafted MongoDB-API request whose payload triggers the hang/crash condition in the request handler, taking the ORDS process offline and severing all REST access to the backing Oracle Database until the service is restarted. Because the attack is automatable and repeatable, the attacker can re-issue the request on each restart, producing sustained outage; no public exploit identified at time of analysis, but the low complexity makes weaponization straightforward once a researcher publishes details.