A flaw in Oracle REST Data Services allows an unauthenticated attacker to issue HTTP requests and potentially create, modify, or delete critical data. The vulnerability is classified as a moderate integrity impact with a CVSS 3.1 base score of 5.9, indicating that while confidentiality is not directly affected, the attacker can alter or erase data that should be protected.

The affected product is Oracle REST Data Services, a backend service used to expose data via REST APIs. Oracle lists the vulnerable releases as 24.2.0 through 26.1.0 and references the security alert for those versions.

The vector is network-based, with the attacker only requiring HTTP access to the REST service and no authentication credentials. Although the exploit is described as difficult, the lack of authentication or proper access controls allows a remote attacker to compromise data integrity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so the public exploit data remains limited.