---
id: "CVE-2026-91610"
kind: "vulnerability"
aliases: ["CVE-2026-91610"]
title: "Oracle REST Data Services: low-privilege HTTP user can take over server"
severity: "high"
cvss: 8.8
epss: 0.00389
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle REST Data Services", "fixed": ["26.2.3"], "affected": ">= 24.2.0, <= 26.2.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle", "oracle-rest-data-services", "runtime", "self-hosted"]
not_affected_if: ["default-config", "not-running-ords"]
published_at: "2026-10-20T22:21:01+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91610", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:51:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91610", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle REST Data Services: low-privilege HTTP user can take over server

Oracle REST Data Services 24.2.0 through 26.2.2 has a flaw in the General component. An attacker with a low-privilege account and HTTP access can take over the service (CVSS 3.1 8.8, full confidentiality, integrity and availability impact). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle REST Data Services affected >= 24.2.0, <= 26.2.2 fixed 26.2.3

## How to check

Find your ORDS version with 'java -jar ords.war version' or from the ORDS startup log; versions 24.2.0 through 26.2.2 are affected. Also check whether ORDS HTTP endpoints are reachable by any user with low-privilege credentials.

## Fix

Install the Oracle October 2026 CPU patch for ORDS. Armis says upgrade to 26.2.3 or later; this is unconfirmed by Oracle, so check the CPU patch availability document. Until patched, limit network access to ORDS to trusted networks.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91610
- 2026-10-23T23:51:02+00:00 analyst — Oracle CPU Oct 2026 (CVE record from Oracle CNA): ORDS 24.2.0-26.2.2, CVSS 8.8, low-priv HTTP takeover. Fixed version 26.2.3 comes only from Armis (inferred as first version outside the range), not read on an Oracle page; Oracle risk matrix text was truncated before the ORDS section. No exploitation or PoC found; did not search social posts.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91610

## Documents

- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [advisory] CVE Record CVE-2026-91610 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-91610
- [fix] Armis: CVE-2026-91610 https://cve.armis.com/CVE-2026-91610

## From the sources

Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_