Live › vulnerability › CVE-2026-101369
Go to dashboardOracle REST Data Services has a flaw in its Backend-as-a-Service component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. Exploitation requires a person other than the attacker to interact with the target, and the sources say it may affect other products as well.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Oracle REST Data Services in the affected versions 24.2.0 through 26.1.0 that expose the Backend-as-a-Service component over HTTP are exposed. The sources do not say whether the component is enabled by default, so teams not running Oracle REST Data Services in those versions can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101369")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.