A vulnerability in the ADP component of Oracle REST Data Services allows an attacker with limited network access to read a subset of data stored in the service. The weakness is classed as an information‑exposure flaw that can compromise confidentiality. The CVSS vector indicates that no user interaction or elevated privileges are needed; only a standard network connection is required, resulting in a Base Score of 4.3 with a confidentiality impact.

Oracle REST Data Services from version 24.2.0 through 26.1.0, issued by Oracle Corporation.

The CVSS score of 4.3 places the risk in the medium range, but the lack of exploit evidence (EPSS not available) and absence from the KEV catalog suggest a lower immediate threat. An attacker would need to reach the service over HTTP and may obtain a small amount of data, potentially exposing sensitive business information. The attack surface is network‑bound, making mitigation via network controls and timely patching effective. The vulnerability can be leveraged by a legitimate or compromised user with no elevated privileges, emphasizing the need to control network exposure.