---
id: "CVE-2026-101380"
kind: "vulnerability"
aliases: ["CVE-2026-101380"]
title: "Oracle REST Data Services: flaw in ADP lets low-privilege users read and change data"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "http-api", "oracle", "oracle-rest-data-services", "runtime"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:17:45+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:16:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101380", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: flaw in ADP lets low-privilege users read and change data

Oracle REST Data Services has a flaw in its ADP component that lets a low-privilege user over HTTP read and modify some data the service can reach. Exploitation needs a second person to interact with the attack, and the sources say it can affect other products too.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle REST Data Services version and see whether it falls in 24.2.0 through 26.1.0 (unknown exact command in sources)
- Confirm whether the ADP component is in use (unknown in sources)

## Fix

- Upgrade Oracle REST Data Services to a version after 26.1.0 (the fixed version is unknown in the sources)
- Apply the Oracle Critical Patch Update that covers this CVE (unknown in the sources)

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101380

## From the sources

Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_