Oracle ORDS CVE-2026-46842

No special configuration is required beyond having an ORDS instance running versions 24.2.0 through 26.1.0 accessible over HTTPS. The CVSS vector PR:N/AC:L/AV:N confirms unauthenticated network exploitation against default-accessible deployments. Exploitation is limited to data integrity operations (INSERT, UPDATE, DELETE) on 'some' ORDS-accessible data - the scope of writable objects depends on which schemas and tables have been REST-enabled. Confidentiality is not impacted (no data read), and availability is not impacted (no denial of service). Exploitation is further constrained to the subset of REST endpoints that perform write operations; read-only GET endpoints are not a vector. The attack must be conducted over HTTPS (not HTTP), which narrows exploitation to TLS-capable network paths but does not require any special access or credentials.

The CVSS 3.1 base score of 5.3 (Medium) is supported by a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The attack vector is network, complexity is low, no privileges are required, and no user interaction is needed - all of which elevate real-world exploitability. However, the impact is constrained: only Integrity is affected at a Low level (I:L), with no Confidentiality or Availability impact. This means an attacker can corrupt or insert data but cannot read sensitive data or cause service disruption. No EPSS score was provided in the source data, which limits probabilistic exploitation forecasting. There is no KEV listing and no confirmed public exploit code, meaning exploitation remains theoretical at time of analysis. Despite the low CVSS score, organizations with internet-facing ORDS deployments or those where ORDS mediates write access to critical database tables should treat this as a meaningful priority, since authentication bypass enabling unauthorized writes can be chained with other weaknesses to escalate impact. The 'easily exploitable' descriptor in the Oracle advisory aligns with the low-complexity, no-privilege CVSS vector and warrants prompt patching despite the moderate score.

An unauthenticated attacker with network access to an ORDS 24.2.0-26.1.0 instance sends a crafted HTTPS request to a REST-enabled database endpoint, exploiting the authentication bypass in the Core component to skip credential validation. The attacker then issues INSERT, UPDATE, or DELETE operations against accessible ORDS-exposed database objects, potentially corrupting application data or injecting malicious records. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity suggests this is reproducible with minimal effort by a moderately skilled attacker.