Description
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and partial disclosure
Action: Apply Patch
AI Analysis

Impact

Oracle REST Data Services contains a vulnerability in the Core component that permits a low‑privileged network attacker to perform unauthorized insert, update, or delete operations, and to read restricted data via HTTP. The flaw is an access control weakness – an improper authorization (CWE‑285) and missing authorization (CWE‑284) – allowing modification and partial disclosure of sensitive data stored in the service, impacting confidentiality and integrity.

Affected Systems

The affected product is Oracle REST Data Services versions 24.2.0 through 26.1.0, released by Oracle Corporation. Systems running any of these major releases without the latest patch are susceptible.

Risk and Exploitability

The CVSS v3.1 base score is 4.2, indicating a low‑to‑moderate risk. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue over the network using HTTP without elevated privileges; successful exploitation could lead to unauthorized data modifications and read access to a subset of the service’s data.

Generated by OpenCVE AI on October 22, 2026 at 10:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official patch or upgrade Oracle REST Data Services to a version newer than 26.1.0.
  • Restrict network exposure of the REST service by firewall rules or ACLs, ensuring only trusted hosts can communicate over HTTP.
  • Enable logging and monitoring to detect unauthorized data modification or read attempts, and review logs regularly for suspicious activity.

Generated by OpenCVE AI on October 22, 2026 at 10:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Title Unprivileged Data Modification and Disclosure via Oracle REST Data Services
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle rest Data Services
CPEs cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle rest Data Services
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Rest Data Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:10:06.559Z

Reserved: 2026-09-28T15:40:09.475Z

Link: CVE-2026-101382

cve-icon Vulnrichment

Updated: 2026-10-27T11:09:56.967Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:17:45.830

Modified: 2026-10-27T12:16:39.433

Link: CVE-2026-101382

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:15:13Z

Weaknesses