Oracle REST Data Services has a Core component flaw that does not require authentication. An attacker who can reach the service over HTTP can perform updates, inserts, or deletions on data exposed by the service. The vulnerability leads to integrity violations for the affected data while not affecting confidentiality or availability.

The flaw affects Oracle REST Data Services versions 24.2.0 through 26.1.0. Systems running any of these versions with the Core component enabled are at risk.

The CVSS v3.1 score of 5.3 indicates a medium severity due to the lack of authentication barrier and the ability to modify data. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting limited or no known exploitation in the wild. However, because the attack vector is network-based and requires only HTTP access, an adversary with infrastructure visibility can likely exploit it if the service is exposed publicly. The lack of alert and patch information means organizations should treat this as a potential insider or external threat until a vendor fix is applied.