Oracle ORDS EUVD-2026-105775

No special configuration conditions are stated: the vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation over HTTP against a reachable Oracle REST Data Services Core instance running an affected version (24.2.0 through 26.1.0). The primary limiting factor is network reachability - the ORDS HTTP endpoint must be accessible to the attacker (internet-exposed or reachable within the network segment). Impact is further limited to partial integrity: only 'some' ORDS-accessible data can be written (insert/update/delete), with no data disclosure and no service-availability loss. Instances not exposed beyond trusted internal networks, or running versions outside the affected range, are not reachable by this vector.

This is a medium-severity, integrity-only issue (CVSS 3.1 Base 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) rather than a top-tier priority. The CVSS signals are internally consistent: network-reachable (AV:N), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), so it is trivially reachable by any unauthenticated HTTP client - but impact is capped at partial integrity (I:L) with NO confidentiality (C:N) and NO availability (A:N) loss, meaning an attacker can perform unauthorized update/insert/delete to SOME accessible data but cannot read data or take the service down. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or available exploit code. The 'Authentication Bypass' tag is somewhat broader than the description, which states unauthenticated attackers gain limited write access rather than explicitly confirming an auth-bypass mechanism - treat the tag as indicative, not confirmed. Net: easily exploitable and unauthenticated (which raises urgency for internet-exposed ORDS endpoints), but the limited, integrity-only blast radius keeps this below critical. Patch via the Oracle October 2026 CPU when it reaches you.

An unauthenticated attacker who can reach an internet- or network-exposed Oracle REST Data Services endpoint sends a crafted HTTP request to the Core component and obtains unauthorized insert/update/delete access to a subset of ORDS-accessible data, without needing credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, so this remains a theoretical but low-complexity scenario.