Oracle REST Data Services CVE-2026-46830

The ORDS Mongoapi component must be enabled and the ORDS instance must be reachable over HTTPS from the attacker's network position. The CVSS vector PR:N/AC:L/UI:N confirms no authentication, no special configuration complexity, and no user interaction are required. Exploitation is limited to deployments running ORDS versions 24.2.0 through 26.1.0 with the Mongoapi component active - organizations that have never configured or enabled Mongoapi are not exposed. Impact is bounded to reading a subset of data accessible via Mongoapi; no write, delete, or service disruption capability is indicated by the CVSS (I:N/A:N), which limits blast radius compared to higher-severity Oracle CPU findings.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N presents a clear and consistent picture: network-reachable, no authentication required, trivially exploitable, but impact is limited strictly to partial confidentiality loss with no integrity or availability consequences. The 'Easily exploitable' language in the Oracle advisory reinforces the low-complexity rating. No EPSS score is available in the provided data, so automated exploitation probability cannot be quantified. The absence of KEV listing and no identified POC suggests opportunistic mass exploitation has not occurred as of the advisory date, though the zero-authentication, network-accessible nature means exploitation requires minimal sophistication. The practical risk is elevated for organizations that expose ORDS externally or to untrusted networks, particularly where the Mongoapi component is in active use and data sensitivity is high. The scope is limited (S:U), meaning a successful attacker cannot leverage this to pivot beyond the ORDS service boundary.

An unauthenticated attacker with HTTPS network access to an exposed ORDS instance sends crafted requests to the Mongoapi endpoint, exploiting the authentication bypass to enumerate and read data accessible through that interface without presenting any credentials. Because attack complexity is low and no user interaction is required, this scenario is feasible with minimal tooling - a simple HTTP client or MongoDB-compatible driver pointed at the vulnerable endpoint suffices. No public proof-of-concept code has been identified at time of analysis, but the simplicity of the vector means independent rediscovery is plausible.