CVE-2026-101360 in REST Data Services
Summary
by MITRE • 10/20/2026
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The identified vulnerability resides within the Core component of Oracle REST Data Services, specifically affecting supported versions ranging from 24.2.0 through 26.1.0. This security flaw represents a significant risk to organizations relying on this platform for managing and exposing database objects via RESTful APIs. The nature of the defect allows an attacker with low privileges who possesses network access over HTTP to compromise the integrity and confidentiality of the service. Unlike vulnerabilities that require high-level administrative credentials or complex user interaction, this issue can be exploited by a relatively unprivileged actor simply by sending crafted requests through standard web protocols. This lowers the barrier for entry significantly, as it does not require social engineering or physical proximity, relying instead on network reachability and basic authentication bypasses or logic flaws within the service's request handling mechanisms.
The technical flaw enables unauthorized modifications to data accessible through Oracle REST Data Services. Specifically, successful exploitation allows an attacker to perform unauthorized update, insert, or delete operations against database records that are exposed via the API endpoints managed by this component. This directly impacts the integrity of the underlying data stores, potentially leading to data corruption, loss of business logic consistency, or manipulation of critical application states. In addition to write access, the vulnerability also grants unauthorized read access to a subset of accessible data. This means sensitive information that should be restricted based on user roles can be extracted by an attacker who has gained initial foothold through this vector. The combination of both read and write capabilities transforms what might otherwise be a simple information disclosure into a more severe integrity compromise, allowing for active manipulation rather than passive observation.
From an operational perspective, the impact is categorized with a CVSS 3.1 Base Score of 5.4, indicating a medium severity level. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) highlights that while availability remains unaffected, both confidentiality and integrity are compromised at a low to moderate level. This score reflects the balance between the ease of exploitation—requiring only network access and low privileges—and the scope of damage limited to specific subsets of data rather than total system compromise. However, in environments where Oracle REST Data Services is used for critical business operations or exposes sensitive customer information, even medium-severity vulnerabilities can lead to significant regulatory violations, financial loss, and reputational damage due to non-compliance with data protection standards such as GDPR or HIPAA if personal identifiable information is exposed.
This vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the core issue stems from insufficient checks on user permissions when processing HTTP requests. Furthermore, in terms of attack tactics, this behavior corresponds to MITRE ATT&CK techniques related to Data Exfiltration over Web Services and potentially Account Manipulation if the ability to modify data extends to changing access control lists or user profiles within the managed databases. Attackers often leverage such flaws during the initial access phase to pivot into deeper network segments or escalate privileges by manipulating application state, making this a critical point for defensive monitoring and patching strategies.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for versions 24.2.0 through 26.1.0 of Oracle REST Data Services. It is imperative to verify that all instances running these affected versions are updated before they can be exposed to untrusted networks. In addition to patching, administrators should review network segmentation policies to ensure that Oracle REST Data Services endpoints are not directly accessible from the public internet without robust authentication and encryption layers such as TLS. Implementing Web Application Firewalls with rules specifically tuned for REST API abuse can also help detect and block malicious payloads attempting to exploit this logic flaw. Regular auditing of access logs should be conducted to identify any signs of unauthorized data modification or exfiltration that may have occurred prior to remediation, ensuring the integrity of affected datasets is verified post-patch deployment.