CVE-2026-101372

Awaiting Analysis Awaiting Analysis - Queue

Oracle REST Data Services Information Disclosure

Publication date: 2026-10-20

Last updated on: 2026-11-08

Assigner: Oracle

Description

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-08

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101372

EUVD

EUVD-2026-105788

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle REST Data Services	24.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle REST Data Services versions 24.2.0 to 26.1.0. It allows an unauthenticated attacker with network access via HTTP to potentially read some data that should be restricted.

Detection Guidance

Detection involves checking for Oracle REST Data Services versions 24.2.0 to 26.1.0. Verify the installed version by examining the ORDS installation directory or logs for version details. Network scans can identify exposed ORDS endpoints. Check HTTP responses for version headers or error messages indicating the affected component.

Impact Analysis

An attacker could exploit this to gain unauthorized read access to a subset of data accessible through Oracle REST Data Services. This could lead to exposure of sensitive information if the service handles confidential data.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data protection controls. Organizations using affected versions should address this to maintain compliance.

Mitigation Strategies

Upgrade Oracle REST Data Services to a version later than 26.1.0 immediately. If upgrading is not possible, restrict network access to ORDS via firewalls or disable HTTP access. Apply network-level mitigations like WAF rules to block malicious requests targeting ORDS.

Hi! I’m here to help you understand CVE-2026-101372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...