Oracle ORDS EUVD-2026-105780

Requires a valid low-privileged authenticated account on the target Oracle REST Data Services instance (PR:L) plus interaction from a separate, typically higher-privileged user who must view or render the attacker-supplied content (UI:R) - exploitation is specifically tied to the Database Actions component. Limiting factors: this is not a drive-by unauthenticated flaw; the attacker cannot complete the attack alone and depends on social-engineering or workflow-based delivery to a victim, which meaningfully reduces real-world exploitability despite the network attack vector. The scope change means successful exploitation can extend impact to additional products beyond ORDS.

This is a moderate-severity (CVSS 5.4), medium-priority issue rather than a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but constrained flaw: it requires an authenticated low-privileged account (PR:L) AND human interaction from a different user (UI:R), with partial confidentiality and integrity impact and no availability impact. The scope change (S:C) combined with UI:R, C:L, I:L and A:N is the textbook signature of a cross-site scripting / content-injection class flaw, where an attacker-planted payload executes in a victim's context and crosses a trust boundary - note that the input Tags label this 'Authentication Bypass', which conflicts with the CVSS/description signals and should be verified with Oracle. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; the two gating requirements (valid low-priv credentials plus a tricked victim) make opportunistic mass exploitation unlikely. Priority is driven by the scope-change multi-product impact and the broad affected-version range (24.2.0-26.1.0), not by exploitation likelihood. Patch via the Oracle CPU in normal cycle; this is not a drop-everything item absent new exploitation signals.

A low-privileged but authenticated Oracle REST Data Services user injects a malicious payload through the Database Actions component; when a higher-privileged user (e.g., an administrator) subsequently views that content, the payload executes in the victim's authenticated session. Because the scope changes, the attacker can read a subset of data and perform unauthorized update/insert/delete actions in the victim's context, potentially affecting products beyond ORDS itself. No public exploit identified at time of analysis.