The vulnerability exists in the Core component of Oracle REST Data Services. An attacker who has low‑privileged network access through HTTP can exploit the flaw to read a subset of application data that should remain confidential. This results in a moderate confidentiality breach, as the attacker can obtain information that is not intended for public exposure. The CVSS 3.1 score of 5.0 indicates a medium severity impact focusing on confidentiality only.

Oracle REST Data Services from Oracle Corporation. Affected versions include 24.2.0 through 26.1.0.

The CVSS base score is 5.0, with an Attack Vector of Network, Access Complexity Low, Privileges Required Low, and Impact on Confidentiality Low. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation at this time. The report states that attacks may change scope to impact additional products. The likely attack vector is an HTTP request from a low‑privileged network source, and the attacker would need only network connectivity to the REST service. Considering the available metrics, the risk is moderate but non‑negligible for organizations that expose Oracle REST Data Services to external networks.