A vulnerability in the ADP component of Oracle REST Data Services allows an attacker with low privileges and network access via HTTP to read a subset of the service’s data or to perform unauthorized update, insert, or delete operations. The impact is a loss of confidentiality and integrity for the exposed data, as the attacker can alter or exfiltrate stored information.

Oracle Corporation’s Oracle REST Data Services 24.2.0 through 26.1.0 are affected. The flaw is triggered by network traffic directed to the REST endpoints over HTTP and can be exploited by users who do not have elevated privileges.

The base CVSS score of 5.4 indicates a moderate severity with confidentiality and integrity impacts while availability is unaffected. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is network based, a low‑privileged attacker could feasibly access the vulnerable interface if it is exposed to the public or an untrusted network.