CVE-2026-46842
Oracle REST Data Services Unauthorized Data Manipulation
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | rest_data_services | From 24.2.0 (inc) to 26.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Oracle REST Data Services, specifically in the Core component, affecting versions 24.2.0 through 26.1.0.
It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise the service.
Successful exploitation can lead to unauthorized update, insert, or delete operations on some of the data accessible through Oracle REST Data Services.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to perform unauthorized modifications to your data through Oracle REST Data Services.
- Unauthorized updates to data
- Unauthorized insertion of new data
- Unauthorized deletion of existing data
These actions can compromise the integrity of your data without requiring any authentication or user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access via HTTPS to perform unauthorized update, insert, or delete operations on some of the data accessible through Oracle REST Data Services. Such unauthorized data modification can impact data integrity.
Compromise of data integrity may lead to non-compliance with regulations and standards that require protection of data accuracy and integrity, such as GDPR and HIPAA. However, the provided information does not explicitly describe the direct impact on compliance with these standards.