{"id":"CVE-2026-91610","kind":"vulnerability","aliases":["CVE-2026-91610"],"related":[],"title":"Oracle REST Data Services: low-privilege HTTP user can take over server","description":"Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle REST Data Services 24.2.0 through 26.2.2 has a flaw in the General component. An attacker with a low-privilege account and HTTP access can take over the service (CVSS 3.1 8.8, full confidentiality, integrity and availability impact). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":0.00389,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle REST Data Services","fixed":["26.2.3"],"affected":">= 24.2.0, <= 26.2.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle","oracle-rest-data-services","runtime","self-hosted"],"not_affected_if":["default-config","not-running-ords"],"how_to_check":"Find your ORDS version with 'java -jar ords.war version' or from the ORDS startup log; versions 24.2.0 through 26.2.2 are affected. Also check whether ORDS HTTP endpoints are reachable by any user with low-privilege credentials.","fix":"Install the Oracle October 2026 CPU patch for ORDS. Armis says upgrade to 26.2.3 or later; this is unconfirmed by Oracle, so check the CPU patch availability document. Until patched, limit network access to ORDS to trusted networks.","status":"open","published_at":"2026-10-20T22:21:01+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:44+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T22:33:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle REST Data Services: low-privilege HTTP user can take over server","impact":"high","summary":"Oracle REST Data Services versions 24.2.0 through 26.2.2 contain a flaw in the General component that a low-privileged user can trigger over HTTP. A successful attack gives the attacker takeover of the service with full confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-rest-data-services","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the ORDS server and reads or changes its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed version and the exact affected configuration; the NVD entry gives no fix version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":3029,"output_tokens":349,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed version and the exact affected configuration; the NVD entry gives no fix version.","search":"'-2026':15A,18A '-91610':16A,19A '/av':150C '2026':78B '24.2.0':38B,102C '26.2.2':40B,103C '3.1':65B,137C,149C '8.8':66B,140C 'access':58B,113C 'account':55B 'affect':100C 'allow':107C 'attack':49B,110C,123C 'avail':71B,144C 'base':138C 'compon':47B,94C 'compromis':117C 'confidenti':68B,141C 'critic':79B 'cve':14A,17A 'cvss':64B,136C,146C,148C 'data':3A,22A,28B,36B,92C,120C,134C 'easili':104C 'exploit':83B,105C 'fix':73B 'flaw':43B 'found':87B 'full':67B 'general':46B,95C 'h':158C 'h/a':157C 'h/i':156C 'host':33B 'http':8A,57B,115C 'impact':72B,145C 'integr':69B,142C 'l/pr':152C 'l/ui':153C 'low':6A,53B,108C 'low-privileg':5A,52B 'n/ac':151C 'n/s':154C 'network':112C 'octob':77B 'oracl':1A,24B,26B,34B,75B,90C,118C,132C 'oracle':20A 'oracle-rest-data-servic':25B 'patch':80B 'poc':86B 'privileg':7A,54B,109C 'public':85B 'rest':2A,21A,27B,35B,91C,119C,133C 'result':128C 'runtim':30B 'score':139C 'self':32B 'self-host':31B 'server':13A 'servic':4A,29B,37B,63B,93C,121C,135C 'services':23A 'success':122C 'support':96C 'take':11A,60B 'takeov':130C 'u/c':155C 'updat':81B 'user':9A 'vector':147C 'version':97C 'via':114C 'vulner':88C,106C,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91610","severity":null,"published_at":"2026-10-20T22:21:01+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91610:532","url":null,"severity":null,"published_at":"2026-10-23T23:51:02+00:00","modified_at":"2026-10-23T23:51:02+00:00","first_seen_at":"2026-10-23T23:51:02+00:00","fetched_at":"2026-10-23T23:51:02+00:00","note":"Oracle CPU Oct 2026 (CVE record from Oracle CNA): ORDS 24.2.0-26.2.2, CVSS 8.8, low-priv HTTP takeover. Fixed version 26.2.3 comes only from Armis (inferred as first version outside the range), not read on an Oracle page; Oracle risk matrix text was truncated before the ORDS section. No exploitation or PoC found; did not search social posts."},{"source":"epss","external_id":"CVE-2026-91610","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91610","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2196,"url":"https://cve.armis.com/CVE-2026-91610","title":"Armis: CVE-2026-91610","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2201,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91610","title":"CVE Record CVE-2026-91610 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}