This vulnerability is located in the Database Actions component of Oracle REST Data Services. It allows a low‑privileged attacker who can reach the service over HTTP to perform unauthorized update, insert and delete operations on data exposed by the service, read data that should be protected, and cause a partial denial of service of the REST service. The CVSS 3.1 score of 6.3 reflects modest confidentiality, integrity and availability impacts.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected.

The exploit is network‑based via HTTP and requires only low privileged access, making it relatively easy to carry out. There is no evidence of remote code execution, and the EPSS score is < 1%, indicating a very low likelihood of exploitation. The CVSS score suggests moderate risk. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation, yet any organization that runs the affected versions and exposes the service to untrusted networks should consider it a serious threat.