Oracle REST Data Services is vulnerable to an unauthenticated HTTP attack that can lead to unauthorized updates, inserts, or deletions and limited read access to data. The weakness allows an attacker to exploit the Core component without credentials, but the attack requires another person’s interaction to trigger the compromise. The CVSS 3.1 base score of 5.4 reflects moderate confidentiality and integrity impacts and no availability effect.

The flaw affects Oracle REST Data Services Core versions 24.2.0 through 26.1.0. Enterprise deployments of these releases that expose the REST services over a network are subject to exploitation.

The CVSS score suggests medium severity, and the EPSS score is not available, indicating no known exploitation frequency data. The vulnerability is not listed in CISA’s KEV catalog. Attacks require network access to HTTP interfaces and a secondary human interaction, implying that an attacker cannot complete the exploit purely on their own but can co‑ordinate with a user to trigger the unauthorized data access.