Live › vulnerability › CVE-2026-91609
Go to dashboardOracle REST Data Services has a flaw in its GraphQL component affecting versions 24.2.0 through 26.2.1. A remote attacker with a low-privilege account over HTTP can read data they should not have access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle REST Data Services versions 24.2.0 through 26.2.1 with the GraphQL component reachable over HTTP. The attacker needs a low-privilege account on the service. Sites on other ORDS versions, or without GraphQL exposed, can skip it.
No product ranges from the sources yet.
java -jar ords.war version or the ORDS admin console (unknown if the sources give a different command)26.2.1 (the exact fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91609")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.