Description
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read access to data via HTTP
Action: Apply patch
AI Analysis

Impact

Affects the Core component of Oracle REST Data Services, allowing an unauthenticated attacker with network connectivity to issue HTTP requests that expose a limited set of data. The only impact is confidentiality loss, reflected in the CVSS rating of 3.7, indicating a low‑severity information disclosure vulnerability. No integrity or availability impact is reported.

Affected Systems

Oracle Corporation’s Oracle REST Data Services versions 24.2.0 through 26.1.0 are vulnerable. The problem is confined to the REST Data Services product and does not affect other Oracle products.

Risk and Exploitability

The CVSS Base score of 3.7 classifies the flaw as low risk, and the EPSS score is not available, making the exact exploitation probability uncertain. It is not currently listed in the CISA KEV catalog, implying no widespread, documented attacks. The likely attack vector is a standard HTTP request to an exposed endpoint, requiring no authentication but direct network access to the REST Data Services instance.

Generated by OpenCVE AI on October 22, 2026 at 10:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle REST Data Services to a version newer than 26.1.0 or apply the vendor-provided patch
  • Configure firewall or network segmentation to restrict inbound HTTP traffic to the REST Data Services server
  • Enforce authentication and role‑based access controls to limit data exposure

Generated by OpenCVE AI on October 22, 2026 at 10:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure via Unauthenticated HTTP Requests in Oracle REST Data Services
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle rest Data Services
CPEs cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle rest Data Services
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Rest Data Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-08T19:11:09.628Z

Reserved: 2026-09-28T15:40:09.475Z

Link: CVE-2026-101372

cve-icon Vulnrichment

Updated: 2026-11-08T19:11:05.885Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:17:44.653

Modified: 2026-11-08T20:17:21.030

Link: CVE-2026-101372

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control