Live › vulnerability › CVE-2026-101361
Go to dashboardA flaw in the Core component of Oracle REST Data Services lets a low-privileged user reach data over HTTP that they should not reach. An attacker can read a subset of accessible data and modify or delete some of it, but cannot take down the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Oracle REST Data Services in the affected version range that accept HTTP requests from users holding a low-privileged account. Exposure depends on which schema data is served through ORDS; instances that serve no data to low-privileged users are less exposed. Teams not running ORDS in this range can skip it.
No product ranges from the sources yet.
24.2.0 to 26.1.0java -jar ords.war version or the ORDS install directory, which the sources do not specify in detail: unknown24.2.0 to 26.1.0 as listed in the Oracle Critical Patch Update advisory; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101361")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.