Oracle REST Data Services EUVD-2026-105789

Exploitation requires the attacker to already possess high administrative/application privileges within Oracle REST Data Services (PR:H) AND to lure a separate, non-attacker human into interacting with crafted content over HTTP (UI:R). These two prerequisites are the primary limiting factors: a purely remote, unauthenticated attacker cannot exploit this, and no automated/mass exploitation is feasible because a second human's action is mandatory. Affected deployments are ORDS Core versions 24.2.0 through 26.1.0; impact is limited to unauthorized modification (update/insert/delete) of only some ORDS-accessible data, with no read access and no availability impact.

This is a low-priority vulnerability by every available signal. The CVSS 3.1 base score is 2.4 (Low), with a vector of AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N - network attack vector but gated behind high privileges (PR:H) AND user interaction (UI:R), with only a low integrity impact and no confidentiality or availability impact. No EPSS score was provided in the input, and there is no CISA KEV listing and no POC referenced, so there is no public exploit identified at time of analysis. The combination of a high-privilege prerequisite plus required interaction from a second human, yielding only partial integrity impact on 'some' accessible data, places this firmly in the low-real-risk category rather than an urgent priority. One notable data conflict: the input carries an 'Authentication Bypass' tag, which directly contradicts the CVSS PR:H requirement (an already-high-privileged attacker is the opposite of bypassing authentication) - this tag appears mislabeled and should not drive prioritization. SSVC-style reading: exploitation=none observed, automatable=no (requires human interaction), technical impact=partial. Treat as routine patching during the normal Oracle CPU cycle.

An attacker who already holds high-privileged access to an Oracle REST Data Services deployment crafts a malicious request or link and induces a separate, legitimate user to interact with it over HTTP, resulting in unauthorized update, insert, or delete of a limited subset of ORDS-accessible data. No public exploit code is known, and the dual requirement of pre-existing high privilege plus victim interaction makes opportunistic exploitation impractical. Impact is confined to data integrity - no data disclosure or service disruption occurs.