Oracle ORDS EUVD-2026-105802

Exploitation requires (1) network reachability to the ORDS HTTP endpoint and (2) a valid low-privileged authenticated account on the target Oracle REST Data Services instance (versions 24.2.0 through 26.1.0, Core component). It is explicitly rated HIGH attack complexity (AC:H), meaning the attacker must additionally satisfy conditions outside their control - such as specific server state, timing, or configuration - which materially limits reliable exploitation. No user interaction is needed (UI:N), and there is no availability impact; the achievable outcome is confined to partial reads and partial unauthorized insert/update/delete against a subset of ORDS-accessible data.

This is a genuinely low-priority vulnerability despite the CRITICAL-sounding 'network/unauthenticated' instinct that AV:N can trigger. The Oracle-assigned CVSS 3.1 base score is only 4.2 (Medium), and the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N tells a consistent, de-escalating story: network reachable (AV:N) but HIGH attack complexity (AC:H, meaning conditions outside the attacker's control must be met), and it requires an already-authenticated low-privileged account (PR:L). Impact is limited to partial reads (C:L) and partial unauthorized update/insert/delete (I:L) of a subset of ORDS-accessible data, with no availability impact (A:N) and no scope change (S:U). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active or probable exploitation - this is not confirmed actively exploited and no public exploit is identified. The one point of tension: the input Tags include 'Authentication Bypass,' which conflicts with the description and vector - the description explicitly requires a 'low privileged attacker' (PR:L), not an unauthenticated bypass, so the tag appears mislabeled and should not drive risk upward. Bottom line: a real but minor flaw best handled in routine patch cadence, not an emergency.

An attacker who already holds a low-privileged, authenticated account on an Oracle REST Data Services deployment (versions 24.2.0 through 26.1.0) sends specially crafted HTTP requests to the Core component to read a subset of, and partially modify (insert/update/delete), data they should not be able to access. Because attack complexity is HIGH, the attacker must satisfy conditions outside their direct control (e.g. timing, server state, or specific configuration), making reliable exploitation difficult. No public proof-of-concept or exploit code is identified in the available data.