EUVD-2026-106802
GHSA-76rh-9j3h-2cpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged ORDS account
-
ExploitSend crafted GraphQL query over HTTP
-
ExecutionBypass data-access authorization
-
ImpactExfiltrate critical ORDS data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable Oracle REST Data Services instance with the GraphQL feature/endpoint enabled and exposed over HTTP, plus a valid low-privileged account (PR:L) - exploitation is not possible pre-authentication. No user interaction is needed (UI:N) and complexity is low (AC:L). Exploitation is limited to confidentiality impact (data disclosure); it cannot modify data or affect availability. Affected deployments are those running ORDS versions 24.2.0 through 26.2.1; patching to the October 2026 CPU fixed release removes the exposure. |
| Impact | This is a moderate-severity confidentiality vulnerability (CVSS 3.1 base 6.5) in Oracle REST Data Services' GraphQL component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the description: network-reachable over HTTP, low attack complexity, and requiring only low-level privileges (PR:L) - i.e. an authenticated but unprivileged account. Impact is confidentiality-only (C:H, I:N, A:N), meaning data exposure rather than tampering or outage. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the priority despite the 'easily exploitable' wording from Oracle. The single 'Authentication Bypass' tag conflicts with the PR:L vector - a true authentication bypass would imply PR:N - so this is more accurately an authorization/data-access flaw reachable by any low-privileged user, not a pre-auth bypass; verify the exact access-control semantics with Oracle. Net: a real patch-worthy issue for Oracle shops exposing ORDS GraphQL, but the authentication requirement and confidentiality-only scope place it below critical, pre-auth RCE-class risks. |
| Exploit ScenarioDerived | An attacker holding a low-privileged ORDS/database account sends crafted GraphQL queries over HTTP to the exposed GraphQL endpoint, abusing weak authorization enforcement to read data beyond their intended scope, up to all data accessible to ORDS. No user interaction or elevated privileges are needed, and no public proof-of-concept is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated data disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.2.1 lets a low-privileged attacker with HTTP network access read critical data - potentially all data accessible through ORDS - via the GraphQL component (CVSS 3.1 base 6.5, C:H/I:N/A:N). Exploitation requires a valid low-privileged account and a reachable, GraphQL-enabled ORDS endpoint, and is confined to confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
RemediationAI
Apply the fixed release published in Oracle's October 2026 Critical Patch Update (advisory: https://www.oracle.com/security-alerts/cpuoct2026.html), which Oracle states removes the exposure for ORDS 24.2.0 through 26.2.1; the advisory should be consulted for the exact patched ORDS version and any prerequisite database or Java changes. Where patching cannot be completed immediately, disable the GraphQL endpoint in ORDS configuration (for example by removing or blocking the GraphQL servlet mapping / setting the GraphQL feature off) - this eliminates the attack surface but breaks any GraphQL-dependent applications and integrations. As a secondary control, restrict network access to the ORDS HTTP listener to trusted application tiers and audit low-privileged database accounts for excessive object grants, accepting that network ACLs do not address insider or compromised-credential scenarios. Rotating credentials and reviewing ORDS access logs for anomalous GraphQL queries against the affected versions is advisable while remediation is in progress.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle REST Data Services is a Java-based mid-tier that publishes REST and GraphQL APIs over Oracle Database schemas, and the GraphQL component in this case fails to properly constrain what a low-privileged authenticated principal can query. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows the weakness is reachable over HTTP with no user interaction and low attack complexity, but requires a valid low-privileged account, meaning it is not a pre-authentication bypass despite the 'Authentication Bypass' tag applied by the reporting feed. The provided data assigns no CWE, but the behavior is consistent with an improper authorization / missing access-control check class (CWE-862/863) in which GraphQL query resolution returns objects or fields beyond the caller's intended privileges, producing high confidentiality impact while leaving integrity and availability untouched. CPE data was not supplied; the affected scope is defined by the EUVD entry as Oracle REST Data Services 24.2.0 through 26.2.1, and exposure depends on the GraphQL feature or endpoint being enabled and reachable over HTTP.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP reach with low complexity (AV:N/AC:L), a required low-privilege account (PR:L), no user interaction, and confidentiality-only disclosure (C:H, I/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB