Oracle REST Data Services CVE-2026-46839

Attacker must have network reachability to the ORDS HTTPS listener and a low-privileged ORDS credential (PR:L) - any valid ORDS-authenticated principal, which in many deployments includes self-service or developer-tier REST users. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the target must be running an affected ORDS build in the 24.2.0-26.1.0 range, the ORDS endpoint must be reachable from the attacker's network position, and the attacker must hold or obtain a working ORDS account; purely anonymous unauthenticated exploitation against default configurations is not supported by the CVSS vector. Oracle's advisory does not call out a non-default feature toggle as a prerequisite, so all standard ORDS deployments in the affected range should be assumed exposed.

This is a real high-priority issue rather than a CVSS-inflated one. The vector AV:N/AC:L/PR:L/UI:N is highly favorable to attackers - reachable over the network, low complexity, no user interaction, and only a low-privileged account required, which in ORDS deployments is often any provisioned REST user or even an enrollment-style account. The scope change (S:C) with C:H/I:H/A:H is the decisive signal: compromise propagates beyond ORDS into the database tier it brokers, which is typically the crown-jewel asset. EPSS, KEV status, and SSVC decision points were not provided in the input, so exploitation probability and automatability cannot be quantified, and no public exploit identified at time of analysis. CWE is N/A and Oracle's CPU advisories are intentionally terse, so the precise root cause is not independently confirmed - defenders should treat the 9.9 score and scope change as the actionable signal and not wait for third-party EPSS data before patching.

An attacker obtains or is provisioned a low-privileged ORDS account - for example a self-service REST user, a developer credential leaked in a repository, or a tenant account in a multi-tenant deployment - and reaches the ORDS HTTPS endpoint over the network. They issue crafted REST requests against the Core component that escalate their effective privileges within ORDS, achieve full takeover of the service, and via the scope change pivot into the backing Oracle Database and any data ORDS proxies. No public exploit identified at time of analysis, but the low attack complexity and absence of user interaction make weaponization straightforward once technical details emerge.