Live › vulnerability › CVE-2026-101359
Go to dashboardOracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in their Core component that an unauthenticated attacker can reach over HTTP. A successful attack lets the attacker update, insert or delete some of the data the service exposes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Oracle REST Data Services 24.2.0 through 26.1.0 with an HTTP endpoint reachable from the network are exposed. The sources do not say whether a particular configuration or data path is required, so treat any reachable ORDS instance in the range as in scope. Installations outside the affected version range can skip it.
No product ranges from the sources yet.
java -jar ords.war version or the ORDS admin page, and compare it to the affected range 24.2.0-26.1.026.1.0 as published in Oracle's Critical Patch Update advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101359")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.