CVE-2026-101380 in REST Data Services
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle REST Data Services, specifically affecting components categorized under ADP across supported versions ranging from 24.2.0 to 26.1.0. This security flaw represents a significant risk vector for organizations relying on this platform for managing database-centric web services and APIs. The core technical nature of the issue involves an authorization bypass or improper access control mechanism that allows low-privileged attackers, who possess network access via HTTP, to manipulate data within the service environment. Unlike high-severity vulnerabilities that permit immediate remote code execution or full system compromise, this specific flaw requires a more nuanced exploitation path involving human interaction. Specifically, successful exploitation necessitates that a user other than the attacker performs an action, such as clicking a malicious link or interacting with a crafted request, which triggers the underlying logic error within the ADP component. This dependency on user interaction classifies the attack vector under social engineering principles, where the technical flaw serves as the mechanism to escalate privileges or access restricted data once the human element is compromised.
From an operational impact perspective, the consequences of this vulnerability are twofold, affecting both confidentiality and integrity while leaving availability intact. The CVSS 3.1 base score of 5.4 reflects a medium severity rating driven by these dual impacts. On one hand, attackers can achieve unauthorized read access to a subset of data accessible through Oracle REST Data Services. This means sensitive information stored in the backend databases exposed via this service could be exfiltrated without proper authentication checks being enforced correctly during specific request flows. On the other hand, and potentially more damagingly, the vulnerability allows for unauthorized update, insert, or delete operations against some of the accessible data. This integrity violation enables attackers to alter records, inject malicious entries, or remove critical information, thereby corrupting the state of the application's underlying database. The scope change noted in the advisory indicates that while the flaw is localized within Oracle REST Data Services, its exploitation can significantly impact additional products connected to it, expanding the blast radius beyond just the service itself to include any dependent applications or data stores linked through this interface.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-434 Unrestricted Upload of File with Dangerous Type if file handling is involved in the ADP component's logic, though the primary issue appears to be access control related. The requirement for human interaction places it within the ATT&CK technique T1566 Phishing or similar social engineering vectors where an attacker lures a user into triggering the exploit. Furthermore, because the attack vector involves network access via HTTP and targets data manipulation, it relates closely to MITRE ATT&CK sub-techniques under Data Exfiltration over C2 channels or Data Manipulation. The low privilege requirement for the initial attacker suggests that even users with minimal permissions within the Oracle ecosystem can leverage this flaw if they are targeted by an external adversary who has crafted a specific payload designed to exploit the ADP component's handling of requests.
Mitigation strategies must focus on both immediate technical controls and long-term architectural changes. The primary recommendation is to apply the latest security patches provided by Oracle for versions 24.2.0 through 26.1.0, as these updates typically contain fixes that enforce stricter authorization checks within the ADP component. Organizations should also implement network-level segmentation to restrict HTTP access to Oracle REST Data Services only from trusted IP ranges or internal networks where possible, reducing the attack surface for external low-privileged attackers. Additionally, deploying Web Application Firewalls with rulesets tuned to detect anomalous request patterns associated with data manipulation attacks can provide an additional layer of defense. Security awareness training is also critical given the human interaction requirement; users should be educated on recognizing suspicious links or requests that might trigger such vulnerabilities. Regular auditing of access logs for unusual read or write operations by low-privileged accounts can help in early detection of exploitation attempts before significant data loss occurs.