{"id":"CVE-2026-101362","kind":"vulnerability","aliases":["CVE-2026-101362"],"related":[],"title":"Oracle REST Data Services: unauthenticated flaw lets attackers change and read data","description":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N).","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that can be reached over HTTP without logging in. A successful attack, which needs a user other than the attacker to take an action, can create, change or delete critical data and read a subset of the data the service can access.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-database","oracle-rest-data-services","ords","runtime","self-hosted"],"not_affected_if":["version-outside-24.2.0-26.1.0"],"how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0` (for example with `java -jar ords.war version` or the version shown in the ORDS admin pages; the sources do not give an exact command).\n- unknown for any other check.","fix":"- Move Oracle REST Data Services to a version newer than `26.1.0` as published in Oracle's security advisory; the sources do not name the fixed version.\n- unknown for any other action.","status":"open","published_at":"2026-10-20T22:17:43+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:40:25+00:00","updated_at":"2026-10-25T03:40:25+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:40:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a version newer than `26.1.0` as published in Oracle's security advisory; the sources do not name the fixed version.\n- unknown for any other action.","reach":"network","title":"Oracle REST Data Services: unauthenticated flaw lets attackers change and read data","impact":"medium","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that can be reached over HTTP without logging in. A successful attack, which needs a user other than the attacker to take an action, can create, change or delete critical data and read a subset of the data the service can access.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","ords","oracle-database","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker creates, changes or deletes critical data and reads some data.","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed ORDS version and the exact user interaction required; the NVD entry alone does not give a fix.","how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0` (for example with `java -jar ords.war version` or the version shown in the ORDS admin pages; the sources do not give an exact command).\n- unknown for any other check.","needs_analyst":true,"not_affected_if":["version-outside-24.2.0-26.1.0"],"who_is_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 that are reachable over HTTP from the network. The sources say exploitation needs a second person to interact with the attacker's request, so exposure depends on whether users of the service are likely to be tricked into that interaction. Deployments on unaffected versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":3528,"output_tokens":668,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101362':15A,18A '-2026':14A,17A '/av':207C '24.2.0':37B,103C '26.1.0':39B,104C '3.1':195C,206C '6.9':198C 'access':88B,114C,166C,176C,183C,192C 'action':70B 'addit':149C 'affect':101C 'allow':109C 'attack':8A,58B,66B,111C,124C,134C,145C,154C 'base':196C 'c/c':212C 'chang':9A,73B,152C 'compon':46B,95C 'compromis':118C 'confidenti':199C 'core':45B,96C 'creat':72B 'creation':162C 'critic':76B,168C 'cve':13A,16A 'cvss':194C,203C,205C 'data':3A,12A,25B,34B,77B,84B,93C,121C,143C,169C,174C,177C,190C,193C 'databas':21B 'delet':75B,163C 'difficult':105C 'exploit':107C 'flaw':6A,42B 'h/a':214C 'h/pr':209C 'host':31B 'http':52B,116C 'human':126C 'impact':148C,202C 'integr':201C 'interact':127C 'l/i':213C 'let':7A 'log':54B 'may':146C 'modif':165C 'n':215C 'n/ac':208C 'n/ui':210C 'need':60B 'network':113C 'oracl':1A,20B,23B,32B,91C,119C,141C,172C,188C 'oracle-databas':19B 'oracle-rest-data-servic':22B 'ord':27B 'person':130C 'product':150C 'r/s':211C 'reach':50B 'read':11A,79B,182C 'requir':125C 'rest':2A,24B,33B,92C,120C,142C,173C,189C 'result':159C 'runtim':28B 'scope':151C 'score':197C 'self':30B 'self-host':29B 'servic':4A,26B,35B,86B,94C,122C,144C,175C,191C 'signific':147C 'subset':81B,186C 'success':57B,123C,153C 'support':97C 'take':68B 'unauthent':5A,110C 'unauthor':161C,181C 'user':62B 'vector':204C 'version':36B,98C 'via':115C 'vulner':89C,108C,138C,157C 'well':179C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 that are reachable over HTTP from the network. The sources say exploitation needs a second person to interact with the attacker's request, so exposure depends on whether users of the service are likely to be tricked into that interaction. Deployments on unaffected versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101362","severity":null,"published_at":"2026-10-20T22:17:43+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}