CVE-2026-101377

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Oracle REST Data Services

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Oracle

Description

Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101377

EUVD

EUVD-2026-105793

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle REST Data Services	24.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle REST Data Services (Database Actions) affecting versions 24.2.0 to 26.1.0. It allows a high privileged attacker with network access via HTTP to cause a partial denial of service (partial DOS) of the service. The impact is limited to availability, with no compromise of confidentiality or integrity.

Detection Guidance

Detection requires checking the version of Oracle REST Data Services. Compare installed version against affected versions 24.2.0 to 26.1.0. Use commands like 'curl -s http://[server]:[port]/ords/ | grep -i version' or check logs for Database Actions access attempts.

Impact Analysis

If exploited, this vulnerability could disrupt access to Oracle REST Data Services, leading to reduced functionality or downtime for users relying on this service. The impact is partial and requires high privileges, limiting the risk to most users.

Compliance Impact

This vulnerability causes a partial denial of service in Oracle REST Data Services, which could disrupt data availability. While it does not directly impact confidentiality or integrity, availability issues may affect compliance with standards requiring timely data access, such as GDPR's data processing requirements or HIPAA's access controls.

Mitigation Strategies

Upgrade Oracle REST Data Services to a version later than 26.1.0. Restrict network access to HTTP ports via firewalls. Apply least privilege principles by limiting high-privileged user access to Database Actions.

Hi! I’m here to help you understand CVE-2026-101377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...