EUVD-2026-105782
GHSA-637c-23wg-52r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege ORDS account
-
ExploitSend crafted HTTP request to ADP component
-
ExecutionBypass data access restrictions
-
ImpactRead unauthorized subset of ORDS data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid low-privilege authenticated account on Oracle REST Data Services (CVSS PR:L) and network HTTP access to the ADP component; it does not work against unauthenticated outsiders. The affected versions are ORDS 24.2.0 through 26.1.0. Limiting factors: authentication is mandatory, impact is confined to read-only disclosure of a subset of accessible data (no write/integrity or availability effect), and no user interaction is needed. The exact ADP configuration or feature state that must be present is not specified in the advisory, so defenders should confirm whether the ADP component is enabled in their deployment. |
| Impact | This is a moderate-severity information-disclosure issue, not a top-tier priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable, low-complexity attack requiring an already-authenticated low-privileged account, yielding only partial confidentiality loss (C:L) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent except for one conflict: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L requirement (the attacker must already hold valid low-privilege credentials, so this is not an unauthenticated bypass) and the description's own 'low privileged attacker' wording - treat the tag as likely mislabeled rather than evidence of a pre-auth flaw. Net assessment: a real but low-urgency vulnerability best handled in normal Oracle Critical Patch Update cycles rather than as an emergency, given the authentication precondition and limited (read-only, partial) impact. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privilege Oracle REST Data Services account sends crafted HTTP requests to the ADP component and gains unauthorized read access to a subset of ORDS-accessible data they should not be able to view. No public exploit code was identified in the provided data, and the attack requires network access plus existing authenticated credentials, limiting it to insiders or attackers who have obtained low-level access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privilege information disclosure in Oracle REST Data Services 24.2.0 through 26.1.0 allows an authenticated user with network HTTP access to the ADP component to read a subset of ORDS-accessible data beyond their intended authorization scope. The flaw is remotely reachable and requires no user interaction, but it is gated behind a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) and causes only confidentiality impact - no write, integrity, or availability effect. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a moderate-severity exposure that matters most where ADP is enabled and low-privilege accounts are broadly issued.
RemediationAI
Patch status: patch available per vendor advisory - Oracle addresses this in its Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative source for the exact fixed ORDS version; the precise fix build number is not specified in the provided data, so confirm the target release against the CPU matrix before upgrading, and note that ORDS upgrades require a re-run of the ords install/upgrade command against the existing configuration directory. If the upgrade cannot be applied immediately, compensating controls are: disable or undeploy the ADP component if it is not actively used (the surest mitigation, but it breaks any dependent application workflows); front ORDS with a reverse proxy or WAF rule that restricts the ADP URI paths to trusted service accounts or internal network ranges (effective against external attackers but not against a malicious insider holding a legitimate low-privilege account); and enforce least privilege by auditing ORDS database schemas and OAuth roles so that only accounts that genuinely need ADP data can reach it. Because exploitation requires a valid low-privilege account, restricting self-registration and aggressively pruning dormant ORDS users materially reduces exposure. Monitor ORDS access logs for anomalous reads against ADP endpoints by low-privileged principals to detect post-patch probing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services (ORDS) is a Java-based mid-tier that publishes Oracle Database content as RESTful web services, underpinning AutoREST, SQL Developer Web, APEX connectivity, and OAuth-secured API endpoints. This CVE sits in the ADP component of ORDS, whose exact configuration or feature state is not described in the Oracle CPU advisory, so the precise vulnerable endpoint or permission check cannot be pinned down from public data. No CWE is assigned, but the behavior - an authenticated low-privileged principal retrieving data it should not see over HTTP - is consistent with the broken access control / missing authorization check class, where an endpoint performs authentication but fails to enforce object- or role-level authorization. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack surface is the network listener, that no special conditions or user interaction are needed, and that the blast radius is scoped (S:U) to partial confidentiality loss. Defenders should note that the presence of the ADP component in their deployment is the key precondition and should be verified rather than assumed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP reach gives AV:N/AC:L; an existing low-privilege account is required so PR:L; only partial read disclosure yields C:L with I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB