A vulnerability exists in the Core component of Oracle REST Data Services that is easily exploitable by a low privileged attacker who has network access to the service over HTTPS. Exploitation leads to full takeover of the REST service, resulting in complete compromise of confidentiality, integrity, and availability of the affected instance.

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. The vulnerability is specific to the Core component of the product.

The CVSS score is 9.9, indicating critical severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is HTTPS, requiring only low privilege network access; the vulnerability can also affect additional products due to scope change. The high severity combined with ease of exploitation makes this a high‑risk threat for any deployment of the affected versions.