EUVD-2026-106803
GHSA-c9r6-6m55-3hrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege ORDS account
-
DeliverySend crafted HTTP request to ORDS endpoint
-
ExploitExploit flaw to bypass authorization
-
ExecutionGain full control of ORDS service
-
ImpactAccess data and pivot to backend database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle REST Data Services HTTP interface plus a valid low-privileged account (PR:L) - it is not reachable by a fully unauthenticated attacker. No user interaction, no special timing, and no non-default configuration are indicated (AC:L/UI:N), and the description states exploitation is 'easily exploitable' against supported versions 24.2.0 through 26.2.2. The primary limiting factors are the requirement for prior low-level authentication to ORDS and network reachability of the ORDS endpoint; environments that restrict ORDS exposure to trusted networks and tightly control low-privilege account issuance materially reduce realistic risk. |
| Impact | This is a credible high-priority issue, though not an emergency on current signals. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an easily exploitable, network-reachable flaw over HTTP requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss - Oracle explicitly characterizes the outcome as 'takeover of Oracle REST Data Services.' No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated risk here derives from the intrinsic severity and ease of exploitation rather than from observed in-the-wild activity. One notable inconsistency: the input Tags label this 'Information Disclosure,' but the CVSS vector and description assert full I:H/A:H impact and complete product takeover - the tag understates the actual impact and should not be relied upon. CWE is N/A and no CPE strings were supplied, so affected-configuration matching rests solely on the Oracle advisory's version range (24.2.0-26.2.2). |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on an internet- or network-reachable Oracle REST Data Services instance sends crafted HTTP requests to the ORDS endpoint and abuses the flaw to escalate to full control of the ORDS service. Because AC:L and UI:N apply, no special timing, race condition, or victim interaction is needed. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated low-privileged attackers can achieve full takeover of Oracle REST Data Services in versions 24.2.0 through 26.2.2 by sending crafted HTTP requests to the ORDS interface, with high impact to confidentiality, integrity and availability (CVSS 8.8). Oracle rates the flaw easy to exploit - no user interaction, no race condition and no non-default configuration is required - so the practical barriers are simply any valid low-privilege ORDS account plus network reachability of the ORDS listener. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so active exploitation is not confirmed; realistic risk is concentrated in internet-exposed ORDS deployments that issue accounts broadly.
RemediationAI
Apply the ORDS update delivered in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the exact fixed build is not stated in the available data, so confirm the patched release against the CPU patch-availability table for the 24.2.0-26.2.2 range before closing the finding. Because exploitation requires network reachability plus a low-privilege account, the highest-value interim control is to stop exposing the ORDS listener directly to the internet and restrict it by firewall or ACL to known application tiers - the trade-off is that legitimate external API clients must be re-homed behind a gateway. In parallel, audit and shrink the low-privilege account population: disable unused ORDS users, enforce least privilege on REST-enabled schemas, and rotate credentials in connection pools whose compromise would convert an ORDS escalation into database access. Fronting ORDS with a reverse proxy or WAF that enforces authentication and request-rate limits adds detection and throttling opportunity at the cost of latency and possible breakage of legitimate REST traffic, while enabling detailed ORDS and database audit logging improves detection of anomalous requests from low-privileged sessions at the cost of log volume and storage. None of these compensating controls fixes the underlying flaw - they only shrink the attacker pool and the reachable surface until the CPU update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based middle tier that publishes RESTful endpoints over an Oracle Database, translating HTTP verbs into SQL and PL/SQL calls and typically sitting in front of REST-enabled schemas. The defect is in the 'General' component, and Oracle has not published a root-cause class (no CWE is assigned), so the specific flaw - an authorization boundary in a REST handler, a privilege check bypass on a routed request, or similar - is not publicly documented beyond the vendor advisory. The CVSS vector is the most informative artifact: PR:L defines the trust boundary as an authenticated session, meaning the attacker begins with some legitimate low-privileged account and escalates from there to full control of the ORDS instance rather than merely reading data already entitled to that account; AC:L/UI:N indicates the escalation is deterministic and requires no victim action or timing window; and S:U means the compromise remains within ORDS's own security authority per the vector, though in practice ORDS connection pools frequently hold database credentials, which is why the takeover impact is rated high across all three pillars.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector with low attack complexity and no user interaction; PR:L reflects the required low-privilege account, and full takeover justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle REST Data Services versions 24.2.0 through 26.2.2 contain a high-severity flaw that can let any valid low-privilege ORDS account take full control of the service, putting connected data and applications at risk. Leadership should prioritize internet-facing ORDS deployments and environments that issue accounts broadly, because no vendor-released patch is identified at time of analysis and no public exploit is identified at time of analysis, yet the practical exposure is an ordinary account plus network reachability.
No vendor-released patch identified at time of analysis; restrict ORDS listener exposure to trusted networks, disable unused accounts, enforce least privilege and strong authentication for ORDS users, deploy WAF or access-control protections in front of exposed instances, and monitor ORDS logs for anomalous requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB