Oracle REST Data Services CVE-2026-46841

No special conditions are required for exploitation per the CVSS vector (AV:N/AC:L/PR:N/UI:N) - any unauthenticated attacker with HTTPS network access to Oracle REST Data Services versions 24.2.0 through 26.1.0 can attempt exploitation against default configurations. The exploit path is over HTTPS (not HTTP), meaning the service must be reachable on its standard TLS-enabled port. Factors that limit exploitation impact include: the data access is confined to 'a subset of Oracle REST Data Services accessible data' (exact scope unspecified by Oracle), there is no integrity or availability impact (read-only), and the unchanged scope (S:U) prevents direct privilege escalation to the underlying Oracle Database. Organizations that have restricted ORDS HTTPS access to trusted internal networks via network controls would effectively reduce attacker reachability despite the vulnerability remaining unpatched.

The CVSS 3.1 base score of 5.3 (Medium) reflects limited but easily achievable impact: the attack vector is network (AV:N), attack complexity is low (AC:L), no privileges are required (PR:N), no user interaction is needed (UI:N), scope is unchanged (S:U), and impact is confined to low confidentiality loss (C:L) with no integrity or availability consequences. This makes the vulnerability technically simple to trigger but operationally bounded - an attacker cannot modify data or disrupt service. The 'Authentication Bypass' tag elevates practical concern because it implies the access control boundary itself is broken, not merely a data leakage edge case. Without KEV listing, POC code, or EPSS data, real-world exploitation urgency cannot be independently corroborated. The risk profile is most concerning for environments where ORDS exposes sensitive data subsets - such as APEX applications, financial or PII-adjacent REST APIs, or cloud-integrated services - where even read-only unauthorized access constitutes a meaningful compliance or breach event. No conflicting signals exist between the CVSS vector and description: both consistently indicate unauthenticated network exploitation.

An attacker with HTTPS network access to an unpatched ORDS instance (versions 24.2.0-26.1.0) crafts a request to an ORDS REST endpoint that bypasses the authentication enforcement logic, successfully retrieving data from accessible ORDS-managed resources without presenting any credentials. No public exploit code has been identified at time of analysis, so exploitation likely requires attacker knowledge of ORDS API structure or endpoint enumeration. The unchanged scope (S:U) limits the blast radius to data served through ORDS itself rather than enabling lateral movement into the underlying Oracle Database engine directly.