{"id":"CVE-2026-101364","kind":"vulnerability","aliases":["CVE-2026-101364"],"related":[],"title":"Oracle REST Data Services: Database Actions flaw exposes data to low-privilege users","description":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","summary":"Oracle REST Data Services has a flaw in its Database Actions component that lets a low-privileged attacker over HTTP read and change some data it can reach. Exploitation needs a second person to act, and the sources say it can affect other products beyond REST Data Services.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-actions","oracle-database","oracle-rest-data-services","vendor"],"not_affected_if":["version-outside-24.2.0-26.1.0"],"how_to_check":"- Check the installed Oracle REST Data Services version (unknown for exact command in sources)\n- Confirm whether Database Actions is enabled on the deployment (unknown)","fix":"- Move Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (fixed version unknown)\n- Apply the vendor's Oracle Critical Patch Update for this CVE (unknown)","status":"open","published_at":"2026-10-20T22:17:43+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:16:25+00:00","updated_at":"2026-10-25T04:16:25+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:16:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (fixed version unknown)\n- Apply the vendor's Oracle Critical Patch Update for this CVE (unknown)","reach":"network","title":"Oracle REST Data Services: Database Actions flaw exposes data to low-privilege users","impact":"medium","summary":"Oracle REST Data Services has a flaw in its Database Actions component that lets a low-privileged attacker over HTTP read and change some data it can reach. Exploitation needs a second person to act, and the sources say it can affect other products beyond REST Data Services.","category":"vendor","nicknames":[],"who_cares":["oracle-rest-data-services","database-actions","oracle-database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Unauthorized data changes and partial reads of REST-accessible data","analyst_note":"Find the fixed version and patch link for the Oracle CPU that lists CVE-2026-101364 and confirm the Database Actions default setting.","how_to_check":"- Check the installed Oracle REST Data Services version (unknown for exact command in sources)\n- Confirm whether Database Actions is enabled on the deployment (unknown)","needs_analyst":true,"not_affected_if":["version-outside-24.2.0-26.1.0"],"who_is_affected":"Deployments of Oracle REST Data Services in the 24.2.0 through 26.1.0 range that expose Database Actions over HTTP to users with low privileges. The sources do not say which configurations are most exposed, so teams running these versions should treat them as affected. Systems outside that version range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3526,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101364':17A,20A '-2026':16A,19A '/av':199C '24.2.0':97C '26.1.0':98C '3.1':187C,198C '5.4':190C 'access':108C,160C,168C,175C,184C 'act':68B 'action':6A,23B,43B,90C 'addit':143C 'affect':75B,95C 'allow':102C 'attack':51B,105C,118C,128C,139C,148C 'base':188C 'beyond':78B 'c/c':204C 'chang':56B,146C 'compon':44B,88C 'compromis':112C 'confidenti':191C 'cve':15A,18A 'cvss':186C,195C,197C 'data':3A,9A,30B,35B,58B,80B,86C,115C,137C,166C,169C,182C,185C 'databas':5A,22B,26B,42B,89C 'database-act':21B 'delet':159C 'easili':99C 'exploit':62B,100C 'expos':8A 'flaw':7A,39B 'http':53B,110C 'human':120C 'impact':142C,194C 'insert':157C 'integr':193C 'interact':121C 'l/a':206C 'l/i':205C 'l/pr':201C 'l/ui':202C 'let':46B 'low':12A,49B,103C 'low-privileg':11A,48B 'may':140C 'n':207C 'n/ac':200C 'need':63B 'network':107C 'oracl':1A,25B,28B,33B,84C,113C,135C,164C,180C 'oracle-databas':24B 'oracle-rest-data-servic':27B 'person':66B,124C 'privileg':13A,50B,104C 'product':77B,144C 'r/s':203C 'reach':61B 'read':54B,174C 'requir':119C 'rest':2A,29B,34B,79B,85C,114C,136C,165C,181C 'result':153C 'say':72B 'scope':145C 'score':189C 'second':65B 'servic':4A,31B,36B,81B,87C,116C,138C,167C,183C 'signific':141C 'sourc':71B 'subset':178C 'success':117C,147C 'support':91C 'unauthor':155C,173C 'updat':156C 'user':14A 'vector':196C 'vendor':32B 'version':92C 'via':109C 'vulner':82C,101C,132C,151C 'well':171C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle REST Data Services in the 24.2.0 through 26.1.0 range that expose Database Actions over HTTP to users with low privileges. The sources do not say which configurations are most exposed, so teams running these versions should treat them as affected. Systems outside that version range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101364","severity":null,"published_at":"2026-10-20T22:17:43+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}