{"id":"CVE-2026-101371","kind":"vulnerability","aliases":["CVE-2026-101371"],"related":[],"title":"Oracle REST Data Services: core flaw lets privileged users alter some data","description":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).","summary":"Oracle REST Data Services has a flaw in its Core component that lets a high-privileged, network-reachable attacker read and change a subset of accessible data. Exploitation is hard and needs a human to take an action.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-rest-data-services","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Oracle REST Data Services version against the affected range 24.2.0 through 26.1.0 (for example with `java -jar ords.war version` or the version shown in the admin console; exact command unknown from sources)","fix":"- Upgrade Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (fixed version unknown from sources)","status":"open","published_at":"2026-10-20T22:17:44+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:47:43+00:00","updated_at":"2026-10-25T04:47:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:47:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (fixed version unknown from sources)","reach":"network","title":"Oracle REST Data Services: core flaw lets privileged users alter some data","impact":"low","summary":"Oracle REST Data Services has a flaw in its Core component that lets a high-privileged, network-reachable attacker read and change a subset of accessible data. Exploitation is hard and needs a human to take an action.","category":"package","nicknames":[],"who_cares":["oracle-rest-data-services","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges modifies or reads some accessible data","analyst_note":"","how_to_check":"- Check the installed Oracle REST Data Services version against the affected range 24.2.0 through 26.1.0 (for example with `java -jar ords.war version` or the version shown in the admin console; exact command unknown from sources)","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 that expose it over HTTP. Exploitation requires an attacker with high privileges and a user to interact with the attack, so exposure is limited to those environments. Systems on other versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000601,"input_tokens":3483,"output_tokens":506,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101371':15A,18A '-2026':14A,17A '/av':167C '24.2.0':82C '26.1.0':83C '3.1':155C,158C,166C 'access':55B,94C,128C,136C,143C,152C 'action':67B 'affect':80C 'allow':88C 'alter':10A 'attack':48B,91C,104C,114C,116C 'base':156C 'chang':51B 'compon':38B,74C 'compromis':98C 'confidenti':159C 'core':5A,37B,75C 'cve':13A,16A 'cvss':154C,163C,165C 'data':3A,12A,22B,30B,56B,72C,101C,134C,137C,150C,153C 'delet':127C 'difficult':84C 'exploit':57B,86C 'flaw':6A,34B 'h/pr':169C 'h/ui':170C 'hard':59B 'high':43B,89C 'high-privileg':42B 'host':27B 'http':96C 'human':63B,106C 'impact':162C 'insert':125C 'integr':161C 'interact':107C 'l/a':174C 'l/i':173C 'let':7A,40B 'n':175C 'n/ac':168C 'need':61B 'network':46B,93C 'network-reach':45B 'oracl':1A,20B,28B,70C,99C,132C,148C 'oracle-rest-data-servic':19B 'packag':24B 'person':110C 'privileg':8A,44B,90C 'r/s':171C 'reachabl':47B 'read':49B,142C 'requir':105C 'rest':2A,21B,29B,71C,100C,133C,149C 'result':121C 'score':157C 'self':26B 'self-host':25B 'servic':4A,23B,31B,73C,102C,135C,151C 'subset':53B,146C 'success':103C,115C 'support':76C 'take':65B 'u/c':172C 'unauthor':123C,141C 'updat':124C 'user':9A 'vector':164C 'version':77C 'via':95C 'vulner':68C,87C,119C 'well':139C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services versions 24.2.0 through 26.1.0 that expose it over HTTP. Exploitation requires an attacker with high privileges and a user to interact with the attack, so exposure is limited to those environments. Systems on other versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101371","severity":null,"published_at":"2026-10-20T22:17:44+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}