Live › vulnerability › CVE-2026-101362
Go to dashboardOracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that can be reached over HTTP without logging in. A successful attack, which needs a user other than the attacker to take an action, can create, change or delete critical data and read a subset of the data the service can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 that are reachable over HTTP from the network. The sources say exploitation needs a second person to interact with the attacker's request, so exposure depends on whether users of the service are likely to be tricked into that interaction. Deployments on unaffected versions can skip it.
No product ranges from the sources yet.
24.2.0 to 26.1.0 (for example with java -jar ords.war version or the version shown in the ORDS admin pages; the sources do not give an exact command).26.1.0 as published in Oracle's security advisory; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101362")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.