Oracle ORDS EUVD-2026-105797

Exploitation requires an attacker to hold a low-privilege account on Oracle REST Data Services (PR:L) with network HTTP access to the ADP component; it is not exploitable by a fully unauthenticated remote attacker. The vulnerability affects ORDS versions 24.2.0 through 26.1.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a single authenticated low-privilege actor - including a malicious insider or an attacker using compromised low-tier credentials - can trigger it against a reachable ORDS instance. Limiting factors: the need for valid credentials and the bounded, partial scope of impact (read a subset, write to some data; no availability effect).

This is a moderate-severity, moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4 Medium) indicates a network-reachable, low-complexity attack that nonetheless requires the attacker to already hold low-level privileges (PR:L) - so it is not a pre-authentication flaw despite the 'Authentication Bypass' tag in the input, which appears inconsistent with PR:L and should be verified. Impact is bounded: partial read (C:L) and partial write/insert/delete (I:L) to a subset of ORDS-accessible data, with no availability impact (A:N) and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization - the risk signals are driven purely by the vendor CVSS, not by observed threat activity. Net: patch in the normal Oracle CPU cycle; the combination of required authentication and limited, partial data impact makes this lower priority than a critical unauthenticated RCE, but the network vector and low attack complexity mean an authenticated insider or a compromised low-privilege account could abuse it.

An attacker who already holds a low-privilege ORDS account (or has stolen such credentials) sends crafted HTTP requests to the ORDS ADP component and gains partial read access plus the ability to insert, update, or delete a subset of ORDS-accessible data beyond their intended authorization. The attack is network-based and low-complexity (AV:N/AC:L) with no user interaction, but requires valid low-level privileges (PR:L). No public exploit code was identified at the time of analysis.