Oracle ORDS EUVD-2026-105786

Exploitation requires a network-reachable Oracle REST Data Services instance (versions 24.2.0 through 26.1.0) exposed over HTTP, and critically depends on human interaction from a person other than the attacker (UI:R) - a victim must be induced to act, so this cannot be driven fully automatically. Attack complexity is high (AC:H), meaning the attacker must satisfy a non-trivial precondition or race/configuration state beyond their control. No authentication is required (PR:N). These factors - mandatory victim interaction plus high complexity - substantially limit realistic exploitation and confine impact to unauthorized read of a subset of ORDS-accessible data; there is no write/integrity or availability impact.

This is a low-priority, high-CVSS-no, low-CVSS issue: Oracle assigns CVSS 3.1 base 3.1 (LOW), and every signal agrees it is a minor exposure. The vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable, unauthenticated flaw that is nonetheless gated by high attack complexity (AC:H) and required human interaction (UI:R), with only partial confidentiality impact (C:L) and no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of exploitation interest or feasibility beyond the theoretical. The signals are internally consistent - a hard-to-exploit, interaction-dependent information leak - rather than conflicting. The one discordant element is metadata, not scoring: the 'Authentication Bypass' tag contradicts the description, which plainly describes unauthorized read access to a subset of data (an information-disclosure issue), not a privilege/authentication bypass. EPSS and KEV are simply absent (not low-despite-KEV); absence here is expected for a freshly disclosed CPU item and should not be read as suppression of risk. Overall: patch in the normal Oracle Critical Patch Update cycle, not an emergency.

An attacker crafts a malicious link or request targeting an internet-reachable Oracle REST Data Services endpoint and lures a legitimate user into interacting with it (UI:R). Because the flaw is difficult to exploit (AC:H) and yields only partial read access, success depends on winning a non-trivial condition and tricking a victim, after which the attacker gains unauthorized read access to a limited subset of ORDS-accessible data. No public exploit code is identified at time of analysis.