Description
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote takeover of Oracle REST Data Services via HTTP with low‑privileged attacker
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows a low‑privileged attacker with network access to compromise Oracle REST Data Services, leading to full takeover of the service. The impact covers confidentiality, integrity, and availability, as noted by the CVSS vector indicating high impacts on all three security objectives.

Affected Systems

The affected product is Oracle REST Data Services, specifically versions 24.2.0 through 26.2.2. All installations of these versions are vulnerable to this condition.

Risk and Exploitability

The CVSS rating of 8.8 reflects a high severity exploitation potential with network access as the attack vector and no user interaction required. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, but the ease of exploitation and the remote takeover capability indicate a serious risk for any unmitigated deployment.

Generated by OpenCVE AI on October 21, 2026 at 11:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle REST Data Services to the latest release following Oracle's CPU Oct 2026 advisory, which contains the fix for this vulnerability.
  • Restrict network traffic to the REST Data Services endpoint using firewalls or cloud security groups, allowing only trusted internal networks to reach the HTTP interface.
  • Enforce authentication and fine‑grained access control on the REST service to remove the feasibility of low‑privileged attackers from exploiting the vulnerability.

Generated by OpenCVE AI on October 21, 2026 at 11:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover via HTTP in Oracle REST Data Services
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle rest Data Services
CPEs cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle rest Data Services
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Rest Data Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:46:06.178Z

Reserved: 2026-09-14T22:10:16.647Z

Link: CVE-2026-91610

cve-icon Vulnrichment

Updated: 2026-10-26T20:45:53.470Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:01.330

Modified: 2026-10-26T21:20:55.230

Link: CVE-2026-91610

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:30:12Z

Weaknesses