Oracle REST Data Services CVE-2026-46840

The vulnerable system must be running Oracle REST Data Services version 24.2.0 through 26.1.0 with the Backend-as-a-Service component reachable over HTTPS from the attacker - this is the default ORDS request listener used by APEX and auto-REST schema deployments. No authentication, no user interaction, and no special configuration are required (AV:N/AC:L/PR:N/UI:N), so any ORDS instance exposed to an untrusted network is exploitable in its default configuration. The principal limiting factor is network exposure: ORDS instances reachable only from internal trusted segments or behind authenticating reverse proxies materially reduce attack surface, and deployments where the BaaS component has been administratively disabled via ORDS configuration would not expose the vulnerable code path.

Every available CVSS signal points to maximum severity: AV:N/AC:L/PR:N/UI:N means a remote attacker needs no credentials, no user interaction, and faces no special complexity, while S:C combined with C:H/I:H/A:H means the attacker can compromise not just ORDS but adjacent components - most likely the underlying database. Oracle itself reported and rated this 10.0, the maximum possible score. However, the intelligence picture is incomplete: no EPSS score, no CISA KEV entry, and no POC are present in the provided data, so widespread opportunistic exploitation is unconfirmed at this point. Given ORDS is a database-fronting service that is frequently internet-exposed by Oracle Cloud and on-prem APEX deployments, and given the 10.0 rating, defenders should treat this as a top-priority patch regardless of the missing exploitation telemetry - the gap between disclosure and weaponization for trivially exploitable, unauthenticated Oracle bugs has historically been short.

An attacker locates an internet-exposed ORDS instance (commonly via Shodan queries for /ords/ or APEX login pages) and sends a crafted HTTPS request to a Backend-as-a-Service endpoint without supplying credentials. The vulnerability allows the request to escape ORDS's authorization model and execute privileged operations, resulting in full ORDS takeover and, via the scope change, compromise of the back-end Oracle Database the service proxies - enabling data exfiltration, modification, or denial of service. No public exploit identified at time of analysis, but the 10.0/AC:L profile means a working POC is likely to emerge quickly once researchers diff Oracle's patch.