CVE-2026-101376

Awaiting Analysis Awaiting Analysis - Queue

Oracle REST Data Services Database Actions Privilege Escalation

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Oracle

Description

Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101376

EUVD

EUVD-2026-105792

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle REST Data Services	24.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle REST Data Services (Database Actions) versions 24.2.0 to 26.1.0. A high privileged attacker with network access via HTTP can exploit it to compromise the service. Successful exploitation may allow unauthorized data access (read, update, insert, delete) and partial denial of service.

Detection Guidance

This CVE affects Oracle REST Data Services versions 24.2.0 to 26.1.0. Detection involves checking the installed version of Oracle REST Data Services and monitoring for unauthorized access attempts via HTTP. Verify the version by checking the application server logs or configuration files for the Oracle REST Data Services installation directory. Look for unusual network traffic or HTTP requests targeting the Oracle REST Data Services endpoints.

Impact Analysis

If you use affected Oracle REST Data Services versions, an attacker could access, modify, or delete sensitive data stored in the database. They could also disrupt service availability, leading to downtime or degraded performance for applications relying on this component.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle REST Data Services versions 24.2.0 to 26.1.0. Restrict network access to HTTP interfaces and enforce least privilege for user accounts.

Hi! I’m here to help you understand CVE-2026-101376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...