{"id":"CVE-2026-101380","kind":"vulnerability","aliases":["CVE-2026-101380"],"related":[],"title":"Oracle REST Data Services: flaw in ADP lets low-privilege users read and change data","description":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","summary":"Oracle REST Data Services has a flaw in its ADP component that lets a low-privilege user over HTTP read and modify some data the service can reach. Exploitation needs a second person to interact with the attack, and the sources say it can affect other products too.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","http-api","oracle","oracle-rest-data-services","runtime"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Oracle REST Data Services version and see whether it falls in 24.2.0 through 26.1.0 (unknown exact command in sources)\n- Confirm whether the ADP component is in use (unknown in sources)","fix":"- Upgrade Oracle REST Data Services to a version after 26.1.0 (the fixed version is unknown in the sources)\n- Apply the Oracle Critical Patch Update that covers this CVE (unknown in the sources)","status":"open","published_at":"2026-10-20T22:17:45+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:16:24+00:00","updated_at":"2026-10-25T04:16:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:16:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Oracle REST Data Services to a version after 26.1.0 (the fixed version is unknown in the sources)\n- Apply the Oracle Critical Patch Update that covers this CVE (unknown in the sources)","reach":"network","title":"Oracle REST Data Services: flaw in ADP lets low-privilege users read and change data","impact":"medium","summary":"Oracle REST Data Services has a flaw in its ADP component that lets a low-privilege user over HTTP read and modify some data the service can reach. Exploitation needs a second person to interact with the attack, and the sources say it can affect other products too.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","oracle","http-api","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads and alters some database-backed data via the service","analyst_note":"Confirm the fixed version and whether the ADP component is enabled by default, using the Oracle security alert for CVE-2026-101380.","how_to_check":"- Check the installed Oracle REST Data Services version and see whether it falls in 24.2.0 through 26.1.0 (unknown exact command in sources)\n- Confirm whether the ADP component is in use (unknown in sources)","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle REST Data Services between 24.2.0 and 26.1.0 that expose it to the network over HTTP. The sources do not say whether the ADP component must be enabled, so exposure beyond the affected version range is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3522,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101380':19A,22A '-2026':18A,21A '/av':198C '24.2.0':96C '26.1.0':97C '3.1':186C,197C '5.4':189C 'access':107C,159C,167C,174C,183C 'addit':142C 'adp':7A,43B,89C 'affect':79B,94C 'allow':101C 'api':26B 'attack':72B,104C,117C,127C,138C,147C 'base':187C 'c/c':203C 'chang':15A,145C 'compon':44B,88C 'compromis':111C 'confidenti':190C 'cve':17A,20A 'cvss':185C,194C,196C 'data':3A,16A,31B,36B,58B,86C,114C,136C,165C,168C,181C,184C 'databas':23B 'delet':158C 'easili':98C 'exploit':63B,99C 'flaw':5A,40B 'http':25B,53B,109C 'http-api':24B 'human':119C 'impact':141C,193C 'insert':156C 'integr':192C 'interact':69B,120C 'l/a':205C 'l/i':204C 'l/pr':200C 'l/ui':201C 'let':8A,46B 'low':10A,49B,102C 'low-privileg':9A,48B 'may':139C 'modifi':56B 'n':206C 'n/ac':199C 'need':64B 'network':106C 'oracl':1A,27B,29B,34B,84C,112C,134C,163C,179C 'oracle-rest-data-servic':28B 'person':67B,123C 'privileg':11A,50B,103C 'product':81B,143C 'r/s':202C 'reach':62B 'read':13A,54B,173C 'requir':118C 'rest':2A,30B,35B,85C,113C,135C,164C,180C 'result':152C 'runtim':33B 'say':76B 'scope':144C 'score':188C 'second':66B 'servic':4A,32B,37B,60B,87C,115C,137C,166C,182C 'signific':140C 'sourc':75B 'subset':177C 'success':116C,146C 'support':90C 'unauthor':154C,172C 'updat':155C 'user':12A,51B 'vector':195C 'version':91C 'via':108C 'vulner':82C,100C,131C,150C 'well':170C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services between 24.2.0 and 26.1.0 that expose it to the network over HTTP. The sources do not say whether the ADP component must be enabled, so exposure beyond the affected version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101380","severity":null,"published_at":"2026-10-20T22:17:45+00:00","modified_at":"2026-10-21T19:16:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}