Live › vulnerability › CVE-2026-101360
Go to dashboardOracle REST Data Services (ORDS) has a flaw in its Core component that lets a low-privileged user reach data over HTTP. Successful exploitation allows unauthorized reads, inserts, updates and deletes of a subset of data the service can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle REST Data Services in the affected version range that expose its HTTP endpoints to users with any valid low-privileged account. Instances not on the affected versions, or not reachable by such users, are less exposed; the sources do not say which specific configurations are required.
No product ranges from the sources yet.
java -jar ords.war version or the ORDS admin page, and compare against the affected range 24.2.0 to 26.1.0.26.1.0 that Oracle lists as fixed (the exact fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101360")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.