EUVD-2026-105776
GHSA-6h9m-7cqq-cv44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged ORDS credentials
-
ExploitSend crafted HTTP request to Core
-
ExecutionBypass data authorization checks
-
ImpactRead and modify accessible ORDS data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged, authenticated account on the Oracle REST Data Services instance (CVSS PR:L) and network HTTP reachability to the ORDS Core component. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the mandatory low-privilege authentication requirement rules out purely anonymous exploitation; affected deployments are specifically ORDS versions 24.2.0 through 26.1.0; and impact is confined to a subset of ORDS-accessible data (partial read plus insert/update/delete), with no availability effect. Realistic risk is highest where ORDS is internet-exposed and low-privileged accounts are broadly provisioned. |
| Impact | This is a moderate-severity issue (CVSS 3.1 base 5.4) in Oracle REST Data Services, best characterized as a high-visibility-but-constrained risk rather than an urgent emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation, but critically requires PR:L - the attacker must already hold low-level authenticated privileges on the ORDS instance. Impact is bounded: partial confidentiality and partial integrity (unauthorized read of a subset of data, and unauthorized insert/update/delete to some data), with no availability impact. There is no CISA KEV listing and no EPSS score supplied in the input, so there is no signal of active or probable exploitation; likewise no public POC is referenced. The Oracle 'Authentication Bypass' tag conflicts with the CVSS/description, which explicitly state a 'low privileged attacker' is required - i.e. authentication is a prerequisite, not bypassed - so that tag should be treated with suspicion and verified with the vendor. Net: real but not a drop-everything priority; prioritize patching during the normal Oracle CPU (October 2026) cycle, giving precedence to internet-exposed ORDS instances where any low-privileged account exists. |
| Exploit ScenarioDerived | An attacker who already possesses a low-privileged ORDS account (or credentials to one) sends crafted HTTP requests to the Core component of a reachable Oracle REST Data Services instance. Because attack complexity is low and no user interaction is needed, the attacker can then read a subset of ORDS-accessible data and perform unauthorized insert/update/delete operations on some of it. No public exploit is identified at time of analysis, so this would require the attacker to develop their own technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an access-control weakness in the Core component that lets a low-privileged, already-authenticated user reach HTTP endpoints they should not be able to modify, yielding partial read plus insert/update/delete access to a subset of ORDS-accessible data (CVSS 3.1 base 5.4, C:L/I:L/A:N). Because the attacker must hold a valid low-privilege account and only HTTP reachability is required, the realistic exposure is greatest on internet-facing ORDS deployments where self-registered or broadly provisioned low-privilege accounts exist. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); patch availability is confirmed per the vendor advisory, but the exact fixed ORDS build number is not specified in the provided data, so confirm the target version against the CPU matrix before upgrading. Until the update is deployed, reduce the attack surface that the PR:L prerequisite depends on: disable or tightly scope REST-enabled (AutoREST) schemas that hold sensitive objects, since doing so removes the exposed endpoints but breaks any applications relying on those APIs; audit and prune low-privileged ORDS accounts and role mappings so that only accounts with a genuine business need can authenticate, accepting that over-broad self-registration or shared service accounts must be re-provisioned; and restrict network reachability to the ORDS listener through a reverse proxy, WAF or allow-list of trusted client ranges, which limits exposure of internet-facing instances at the cost of blocking legitimate remote API consumers. Enable ORDS/SQL audit logging and monitor for anomalous insert, update or delete activity originating from low-privilege sessions, noting that logging only provides detection and not prevention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based mid-tier that exposes Oracle Database content over HTTP as RESTful services, most notably through AutoREST (which publishes tables, views and PL/SQL as JSON endpoints) and the PL/SQL gateway, fronted by a servlet container such as Tomcat or WebLogic. The affected 'Core' component handles request routing, service registration and privilege enforcement for those endpoints. No CWE was assigned, but the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) alongside the 'Authentication Bypass' tagging points to a broken-function-level or missing authorization check: the weakness does not appear to grant anonymous entry, since PR:L requires the attacker to already hold a low-privileged account, but it plausibly allows that account to invoke or manipulate ORDS Core operations beyond its granted schema/role scope. The scope is unchanged (S:U) and there is no availability impact, so the defect is bounded to confidentiality and integrity of a subset of data the service can reach. Practical exploitation therefore hinges on how ORDS privilege mappings, REST-enabled schemas and role grants are configured, which is why internet-exposed instances with liberal low-privilege account provisioning carry the highest realistic risk.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network HTTP access (AV:N) with low complexity (AC:L); the description's 'low privileged attacker' mandates PR:L, not PR:N; partial read and write give C:L/I:L and no availability impact (A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB