CVE-2026-101367 in REST Data Services
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the ADP component of Oracle REST Data Services, affecting supported versions ranging from 24.2.0 through 26.1.0. This flaw represents a significant security deficiency that allows for unauthorized manipulation and access to data managed by the service. The core technical issue stems from insufficient validation or authorization checks within the application logic handling HTTP requests directed at specific endpoints exposed by the ADP module. Because Oracle REST Data Services functions as an interface between database objects and web services, any weakness in its request processing layer can directly translate into direct access to underlying data stores if proper safeguards are not enforced.
The operational impact of this vulnerability is characterized by both confidentiality and integrity breaches. An attacker who successfully exploits this flaw gains the ability to perform unauthorized updates, inserts, or deletes against accessible data within Oracle REST Data Services. This means that critical records can be altered, malicious entries can be injected into databases, or essential information can be permanently removed without authorization. Furthermore, the vulnerability also permits unauthorized read access to a subset of accessible data, leading to potential exposure of sensitive organizational information. The combination of these capabilities allows an attacker to not only steal data but also corrupt it, thereby undermining trust in the integrity of the stored information and potentially disrupting business operations that rely on accurate data states.
From a threat actor perspective, this vulnerability is particularly concerning due to its low barrier for exploitation. It requires only low privileged access and network connectivity via HTTP to execute successful attacks. This implies that an attacker does not need administrative privileges or complex pre-authentication steps to leverage the flaw. The attack vector is classified as Network with Low Attack Complexity, meaning it can be triggered remotely over a network such as TCP/IP without requiring user interaction or specific environmental conditions beyond basic connectivity. The presence of this vulnerability in widely deployed enterprise software increases the risk surface significantly, especially if Oracle REST Data Services instances are exposed to untrusted networks or lack proper segmentation and access controls.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization depending on whether the issue is related to privilege escalation or direct unauthorized access. The ability to modify data corresponds to integrity impacts often associated with CWE-77 SQL Injection if the underlying mechanism involves improper query construction, while read access aligns with information disclosure vulnerabilities. From a tactical standpoint as defined by MITRE ATT&CK, this vulnerability facilitates techniques such as Data Manipulation and potentially Credential Access or Collection if sensitive data is exfiltrated. The specific vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects a medium severity score of 5.4, emphasizing that while availability remains unaffected, the compromise to confidentiality and integrity poses substantial risk to organizational security postures.
Mitigation strategies should prioritize immediate patching by upgrading Oracle REST Data Services to a version where this vulnerability has been resolved. Organizations must ensure they are running supported versions as specified in vendor advisories. In addition to software updates, implementing strict network segmentation is crucial to limit exposure of the ADP component to only trusted internal networks rather than exposing it directly to public internet spaces. Deploying Web Application Firewalls can provide an additional layer of defense by filtering malicious HTTP requests that attempt to exploit this flaw. Furthermore, enforcing strong authentication mechanisms and ensuring that all users interacting with Oracle REST Data Services operate under the principle of least privilege will reduce the impact if a breach occurs. Regular security audits and penetration testing focused on API endpoints should be conducted to identify similar weaknesses in request handling logic before they can be exploited by adversaries.