A vulnerability exists in the Core component of Oracle REST Data Services that is easily exploitable by a low privileged attacker who has network access to the service over HTTPS. Exploitation leads to full takeover of the REST service, resulting in complete compromise of confidentiality, integrity, and availability of the affected instance.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is specific to the Core component of the product.

The CVSS score is 9.9, indicating critical severity. The EPSS score of < 1% indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is HTTPS, requiring only low privilege network access. The vulnerability can also affect additional products due to scope change. The overall risk is critical in terms of potential impact but low likelihood of exploitation at present.