CVE-2026-101368

Awaiting Analysis Awaiting Analysis - Queue

Oracle REST Data Services Unauthorized Data Access

Publication date: 2026-10-20

Last updated on: 2026-11-08

Assigner: Oracle

Description

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-08

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101368

EUVD

EUVD-2026-105784

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle REST Data Services	24.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle REST Data Services versions 24.2.0 to 26.1.0. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the service. Successful exploitation requires human interaction from someone other than the attacker.

Detection Guidance

This vulnerability is specific to Oracle REST Data Services (ORDS) versions 24.2.0 to 26.1.0. Detection involves checking the installed ORDS version and monitoring HTTP traffic for unauthorized access attempts. Use commands like 'ords --version' to verify the version and inspect web server logs for suspicious HTTP requests targeting ORDS endpoints.

Impact Analysis

An attacker could gain unauthorized access to modify, insert, or delete data within Oracle REST Data Services. They could also read a subset of accessible data, potentially leading to data breaches or corruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR, HIPAA, or other regulations requiring data confidentiality and integrity. Compliance could be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Apply the latest security patches for Oracle REST Data Services versions 24.2.0 to 26.1.0. Disable unnecessary HTTP access to the service if possible. Monitor network traffic for unusual activity targeting Oracle REST Data Services endpoints.

Hi! I’m here to help you understand CVE-2026-101368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...