Live › vulnerability › CVE-2026-101374
Go to dashboardOracle REST Data Services has a flaw in its Backend-as-a-Service component that a remote attacker can reach over HTTP without logging in. A successful attack can create, change or delete data that the service can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Oracle REST Data Services in the affected version range that are reachable over HTTP from the network. The sources do not say which configurations expose the Backend-as-a-Service component, so whether a given install is exposed is unknown.
No product ranges from the sources yet.
24.2.0 through 26.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.