Description
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Patch Now
AI Analysis

Impact

This vulnerability in Oracle REST Data Services, as described, permits high‑privileged attackers with network access over HTTP to create, delete, or modify data that the service exposes. The vulnerability is an improper access control flaw—based on the description, it is inferred that privileged users can perform operations they should not be able to. This does not allow arbitrary code execution or denial of service; the primary consequence is loss of data integrity, with the potential to alter or delete critical information accessible through the REST endpoints.

Affected Systems

Oracle REST Data Services version 24.2.0 through 26.1.0 of the Core component is affected. Within those releases, the Core service is vulnerable to the described improper access control flaw.

Risk and Exploitability

The CVSS v3.1 score of 4.9 reflects moderate severity, limited to integrity impact. The attack vector is over the network via HTTP, requiring high privileges to authenticate. EPSS is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no known wild exploitation. Nevertheless, an adversary with elevated rights can modify any data that the REST service exposes, making timely remediation essential.

Generated by OpenCVE AI on October 22, 2026 at 10:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest Oracle REST Data Services release (v26.1.1 or later) or apply the vendor patch for the Core component that addresses the improper access control flaw.
  • Restrict HTTP access to the REST Data Services by applying network segmentation, firewall rules, or VPN requirements, ensuring only authorized, least‑privileged traffic can reach the service.
  • Review and enforce strict role‑based access controls within the service configuration, ensuring that only users with the minimal required permissions can perform create, delete, or modify operations, and monitor logs for attempts to perform unauthorized actions.

Generated by OpenCVE AI on October 22, 2026 at 10:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Improper Access Control Enables Data Modification in Oracle REST Data Services
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle rest Data Services
CPEs cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle rest Data Services
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Rest Data Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:12:48.167Z

Reserved: 2026-09-28T15:40:09.476Z

Link: CVE-2026-101385

cve-icon Vulnrichment

Updated: 2026-10-27T11:12:30.911Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:17:46.167

Modified: 2026-10-27T12:16:42.433

Link: CVE-2026-101385

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:30:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control