---
id: "CVE-2026-101362"
kind: "vulnerability"
aliases: ["CVE-2026-101362"]
title: "Oracle REST Data Services: unauthenticated flaw lets attackers change and read data"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["oracle-database", "oracle-rest-data-services", "ords", "runtime", "self-hosted"]
not_affected_if: ["version-outside-24.2.0-26.1.0"]
published_at: "2026-10-20T22:17:43+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:40:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101362", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: unauthenticated flaw lets attackers change and read data

Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that can be reached over HTTP without logging in. A successful attack, which needs a user other than the attacker to take an action, can create, change or delete critical data and read a subset of the data the service can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0` (for example with `java -jar ords.war version` or the version shown in the ORDS admin pages; the sources do not give an exact command).
- unknown for any other check.

## Fix

- Move Oracle REST Data Services to a version newer than `26.1.0` as published in Oracle's security advisory; the sources do not name the fixed version.
- unknown for any other action.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101362

## From the sources

Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_