EUVD-2026-105910
GHSA-gmq9-mf99-w543
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliverySend crafted HTTP request to ORDS Core
-
ExploitExploit flaw crossing scope boundary
-
ExecutionAccess unauthorized critical data
-
ImpactExfiltrate data from ORDS and linked products
Vulnerability Assessment
| Exploitation Conditions | Requires a reachable Oracle REST Data Services instance (versions 24.2.0-26.2.2) exposed over HTTP and a valid low-privileged account on that instance (CVSS PR:L) - exploitation is not possible fully unauthenticated despite the 'Authentication Bypass' tag, which conflicts with the vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already possess low-level credentials or access to the ORDS authentication context, and impact is confined to confidentiality (no data modification or denial of service). The scope change (S:C) means the realistic blast radius extends to other Oracle products connected to the vulnerable ORDS deployment. |
| Impact | This is a genuine mid-to-high priority issue but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) indicates a network-reachable, low-complexity attack requiring only low-privileged authentication, with a scope change and a high confidentiality impact (integrity and availability unaffected). The scope change is the key risk amplifier: Oracle explicitly states attacks 'may significantly impact additional products,' meaning a compromise of ORDS can expose data in connected components beyond ORDS itself. However, several key signals are MISSING: no EPSS score is provided, so real-world exploitation probability cannot be quantified; the CVE is NOT in CISA KEV (no confirmed active exploitation); and no public POC is referenced. The PR:L requirement meaningfully limits mass exploitation - an attacker needs valid, if low-privileged, credentials or an account on the ORDS instance. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which uses PR:L (authentication required, not bypassed); the Oracle description describes a low-privileged authenticated attacker, not an unauthenticated bypass - treat the tag with skepticism and verify against the Oracle advisory. Net: a real, patch-worthy confidentiality/scope-change flaw, but currently theoretical risk (no EPSS/KEV/POC) rather than demonstrated widespread exploitation. |
| Exploit ScenarioDerived | An attacker holding a low-privileged account on an internet- or network-reachable Oracle REST Data Services instance sends crafted HTTP requests to the Core component to read data they should not be able to access. Because the flaw causes a scope change, the attacker can pivot the confidentiality breach into connected Oracle products, potentially exposing critical data across trust boundaries. No public exploit code is identified at the time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 - consult https://www.oracle.com/security-alerts/cpuoct2026.html to identify the exact patched ORDS build that supersedes your release within the 24.2.0-26.2.2 range, then upgrade the ORDS mid-tier and restart the service. Because the exploited vector requires a valid low-privileged account (PR:L) on the ORDS instance, the highest-value compensating controls while patching are credential and exposure reduction: audit and cull low-privilege ORDS/OAuth accounts and schema mappings you do not actively need, restrict the ORDS HTTP listener to trusted network segments or a reverse proxy with allow-listing (this shrinks the AC:L attack surface but breaks legitimate external API consumers), and tighten ORDS role-to-database-privilege mappings so no low-tier account can reach sensitive schemas (this may break existing integrations and should be tested against application workflows). Enable ORDS request/audit logging and monitor for anomalous enumeration of REST endpoints or unusual data-volume responses from low-privileged sessions, since the sole impact here is confidentiality and such access would otherwise be silent. Organizations that cannot immediately patch should prioritize patching any ORDS instance that is internet-facing or that fronts regulated data, given the S:C scope change and the absence of an integrity/availability side effect to alert on.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based mid-tier that publishes Oracle Database schemas and PL/SQL as RESTful HTTP endpoints, handling its own authentication, authorization, and privilege mapping (OAuth2, first-party/third-party authentication, and database-privilege-based access control) on top of the underlying Oracle Database. The reported problem sits in the ORDS Core component and is tagged as an Authentication Bypass; while no CWE was supplied, the observed behavior - a user holding only low privileges via HTTP gaining high-confidentiality read access across the ORDS-accessible data set - is consistent with an authorization/access-control enforcement weakness in the request-handling or privilege-mapping layer rather than a memory-safety defect. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates the attack surface is the HTTP listener, no user interaction or race condition is required, and the security authority of the vulnerable component is not the same as the impacted component (scope change), meaning compromise of the ORDS tier can cross into connected Oracle products and the backing database. Integrity and availability impacts are explicitly absent, so this is a data-disclosure/authorization-bypass class of defect, not remote code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTP vector (AV:N/AC:L) with required low-privileged account (PR:L), no user interaction, scope change to other products, confidentiality-only high impact (I:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle REST Data Services (ORDS) deployments running versions 24.2.0 through 26.2.2 carry a high-severity confidentiality flaw that lets a holder of a low-privilege ORDS account read data well outside their authorized boundary, and because the flaw crosses a scope boundary, data held in other Oracle products reachable through the same deployment may also be exposed. Integrity and availability are unaffected, but any leaked customer, regulated, or intellectual-property data becomes a disclosure event carrying notification obligations and reputational cost. Leadership should care most about the absence of a vendor fix: exposure must be contained through account governance, monitoring, and network segmentation until Oracle publishes a patch in a future Critical Patch Update.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to ORDS listeners to trusted segments and client ranges, aggressively review and reduce low-privilege ORDS accounts and REST-enabled schemas/endpoints, enforce least-privilege grants so a compromised low-privilege account reaches the minimum data set, enable and centralize ORDS and database audit logging with alerting on anomalous bulk reads, and apply the Oracle Critical Patch Update immediately once a fixed ORDS release is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB