CVE-2026-46840
Oracle REST Data Services Remote Code Execution
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | rest_data_services | From 24.2.0 (inc) to 26.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to take over Oracle REST Data Services, resulting in a complete compromise of confidentiality, integrity, and availability.
Such a compromise could lead to unauthorized access to sensitive data, potentially violating data protection regulations such as GDPR and HIPAA, which require strict controls over data confidentiality and integrity.
Therefore, organizations using affected versions of Oracle REST Data Services may face compliance risks if this vulnerability is exploited.
Can you explain this vulnerability to me?
This vulnerability exists in Oracle REST Data Services, specifically in the Backend-as-a-Service component, affecting versions 24.2.0 through 26.1.0.
It is easily exploitable by an unauthenticated attacker who has network access via HTTPS, allowing them to compromise Oracle REST Data Services.
The vulnerability can lead to a complete takeover of Oracle REST Data Services, potentially impacting additional products beyond the service itself.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can result in a full compromise of Oracle REST Data Services, including confidentiality, integrity, and availability.
- Confidentiality impact: sensitive data could be exposed.
- Integrity impact: data or service could be altered or corrupted.
- Availability impact: service could be disrupted or taken offline.
Because the scope of the attack can extend beyond Oracle REST Data Services, other connected products or systems may also be affected.