A flaw in Oracle REST Data Services allows an unauthenticated attacker who can reach the system over HTTP to compromise the service. Successfully exploiting the vulnerability requires human interaction from a separate user, indicating that automated exploitation is not straightforward. Once exploited, the attacker can create, delete, or alter critical data held by Oracle REST Data Services and can read a subset of data that should otherwise be protected. The impact is chiefly confidentiality and integrity of the data exposed through the service, but not availability.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. Management of these versions is required to prevent exposure.

The vulnerability is rated at CVSS 3.1 score 6.9, indicating moderate severity with confidentiality and integrity impacts. EPSS data is not available, and the flaw is not indexed in the CISA KEV catalog. The attack vector is remote over network via HTTP, and requires an unauthenticated attacker to have network access and to persuade an unrelated user to interact with the service. Because of this dual requirement, the practical exploitability is limited but still poses a significant risk to systems that rely on Oracle REST Data Services for critical data processing.