CVE-2026-101372 in REST Data Services
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle REST Data Services, specifically affecting supported versions ranging from 24.2.0 through 26.1.0. This security flaw represents a significant risk to organizations relying on this middleware for exposing database objects as RESTful services. The nature of the defect allows an unauthenticated attacker who possesses network access via HTTP to compromise the integrity and confidentiality of the Oracle REST Data Services environment. Although the vulnerability is classified as difficult to exploit, its potential impact remains substantial due to the sensitive nature of data typically managed through such platforms.
From a technical perspective, this flaw enables unauthorized read access to a specific subset of data accessible by Oracle REST Data Services. The attacker does not require valid credentials or user interaction to initiate an attack vector, which classifies it as an unauthenticated remote code execution path in terms of initial access. However, the complexity involved in successfully leveraging this vulnerability suggests that automated scanning tools may struggle to detect and exploit it without significant manual effort or specific contextual knowledge. The limitation to read-only access indicates that while data exfiltration is possible, direct system compromise through privilege escalation or write operations is not immediately facilitated by this specific flaw alone.
The operational impact of this vulnerability centers on the breach of confidentiality within the affected systems. By gaining unauthorized access to a subset of accessible data, an attacker can potentially extract sensitive information such as customer records, financial details, or proprietary business logic exposed through REST endpoints. This aligns with common attack patterns where adversaries seek to harvest valuable data for espionage, fraud, or further lateral movement within a network infrastructure. The severity is quantified by a CVSS 3.1 Base Score of 3.7, reflecting low impact on confidentiality and no impact on integrity or availability.
In terms of industry standard classifications, this vulnerability maps closely to CWE-200: Information Exposure, as it involves the unauthorized disclosure of information that should be restricted. Furthermore, from an adversary tactics perspective, it relates to ATT&CK technique T1530: Data from Cloud Storage Object or similar data exfiltration methods where attackers retrieve stored data without proper authorization. The network vector and lack of authentication requirements place this in a category requiring immediate attention despite the high complexity barrier for exploitation.
Mitigation strategies should prioritize applying the latest security patches provided by Oracle to update the Oracle REST Data Services installation to a version beyond 26.1.0 where such flaws are resolved. Organizations must also ensure that their network perimeter defenses, including firewalls and web application firewalls, are configured to restrict HTTP access to only authorized IP ranges or internal networks whenever possible. Implementing strict authentication mechanisms for all API endpoints is critical, as this vulnerability exploits the lack of proper access controls in specific core functions. Regular security audits and penetration testing focused on RESTful interfaces can help identify similar misconfigurations before they are exploited by malicious actors.