Oracle ORDS EUVD-2026-105799

Exploitation requires an affected Oracle REST Data Services instance (versions 24.2.0 through 26.1.0) reachable over HTTP, AND successful social-engineering of a separate victim user into interacting with attacker-supplied content (UI:R) - the attacker cannot complete the attack unassisted. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), but the mandatory human-interaction step is the primary limiting factor and means the attack fails against users who do not take the bait. The granted access is partial: read of only a subset of ORDS data and modification of only some data, with no availability impact, bounding the realistic damage.

This is a moderate-severity issue (CVSS 3.1 base 5.4) in Oracle REST Data Services (ORDS). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N describes a network-reachable, low-complexity, unauthenticated flaw whose critical gating factor is required user interaction (UI:R) from a victim other than the attacker - a signature consistent with a client-side injection class (e.g. reflected/stored XSS or request forgery) rather than a direct server compromise. Impact is partial: low confidentiality and low integrity (unauthorized read of a data subset, plus unauthorized update/insert/delete of some data), with no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation; the only available risk signals are the CVSS metrics themselves. The scope is Unchanged (S:U), limiting blast radius to the ORDS component. The 'Authentication Bypass' tag in the input conflicts with the vulnerability data - unauthorized data access here stems from tricking an interacting user (UI:R), not from bypassing authentication, so that tag appears mislabeled and should not drive prioritization. Net assessment: a real but mid-tier issue appropriate for routine Oracle Critical Patch Update (CPU) cycle remediation rather than emergency response, absent any exploitation evidence.

An attacker crafts a malicious HTTP link or request targeting an ORDS endpoint and lures an authenticated or privileged ORDS user into clicking it. When the victim's browser processes the attacker-controlled content, it triggers unauthorized read of a subset of ORDS-accessible data and unauthorized update, insert, or delete of some data in the victim's context. No public exploit code was identified in the provided intelligence, and success depends entirely on the victim interacting with the attacker's content.