Oracle REST Data Services is affected by an easily exploitable flaw that allows an unauthenticated attacker with network reachability over HTTPS to gain full control over the service. The vulnerability permits bypassing authentication checks, enabling an attacker to manipulate or commandeer the REST endpoints, resulting in complete confidentiality, integrity, and availability loss for the affected deployment.

The affected product is Oracle REST Data Services, with vulnerable versions ranging from 24.2.0 to 26.1.0. Any installation that exposes the Backend‑as‑a‑Service component to external networks is at risk, and because the impact has been flagged as a scope change, other Oracle products that interact with ORDS may also be indirectly affected.

With a CVSS v3.1 base score of 10.0, this issue is classified as critical severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly documented exploits. However, the description indicates that the attacker only needs unauthenticated HTTPS connectivity; this suggests the exploit could succeed trivially once network access is available, but no public exploit metadata is present.