CVE-2026-91610 in REST Data Services
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the General component of Oracle REST Data Services, a platform that enables developers to expose database objects as RESTful APIs for consumption by modern applications and clients. The affected software versions span from 24.2.0 through 26.2.2, representing a significant portion of recent deployments where organizations rely on this service for data integration and application development workflows. This flaw is classified under the category of improper input validation or access control bypass, which aligns with CWE-862 (Missing Authorization) or potentially CWE-94 (Improper Control of Generation of Code), depending on the specific mechanism exploited within the general processing logic. The vulnerability allows an attacker to perform actions that should be restricted based on user privileges, effectively undermining the security model designed to protect sensitive data and system integrity.
Exploitation of this flaw requires only low-privileged credentials and network access via HTTP, indicating that no complex authentication bypass or privilege escalation is necessary prior to triggering the exploit. The attack vector is classified as Network with Low Attack Complexity, meaning an attacker does not need specialized conditions or user interaction to initiate the compromise. This ease of exploitation significantly increases the risk profile for organizations running these versions in internet-facing environments or within internal networks where lateral movement can occur rapidly once initial access is gained. The absence of a requirement for User Interaction further simplifies automated attack scenarios, allowing malicious actors to script and propagate exploits efficiently across vulnerable instances without needing social engineering tactics.
The operational impact of this vulnerability is severe, as indicated by the CVSS 3.1 Base Score of 8.8, which denotes High severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reveals that Confidentiality, Integrity, and Availability are all heavily impacted. A successful exploitation results in the complete takeover of Oracle REST Data Services, granting the attacker full control over the service instance. This level of compromise allows for unauthorized access to underlying database contents, leading to significant data breaches (Confidentiality impact). Furthermore, attackers can modify or delete critical configuration files and API definitions, disrupting business operations and corrupting data integrity. The availability impact suggests that the service can be rendered unusable through denial-of-service techniques facilitated by the same vulnerability vector, causing downtime for dependent applications.
From a tactical perspective, this vulnerability maps to MITRE ATT&CK technique T1078 (Valid Accounts), as it leverages existing low-privileged credentials, and potentially T1505 (Server Software Component) if the exploitation involves injecting malicious components or scripts into the service environment. The ability to take over the service implies that attackers can use Oracle REST Data Services as a pivot point for further attacks against the backend database or other networked systems. This aligns with common adversary behaviors where compromised services are used to exfiltrate data, establish persistence, or move laterally within an enterprise network. Organizations must recognize that even low-privileged accounts pose a critical risk when associated with high-severity vulnerabilities in core infrastructure components like REST API gateways.
Mitigation strategies should prioritize immediate patching of Oracle REST Data Services to the latest available version outside the affected range (24.2.0 through 26.2.2). Until patches are applied, organizations should implement strict network segmentation to limit access to only trusted IP addresses and enforce multi-factor authentication for all administrative interfaces where possible. Additionally, deploying Web Application Firewalls with rules specifically tuned to detect exploitation patterns associated with this vulnerability can provide a layer of defense in depth. Regular auditing of user privileges within the service is also recommended to ensure that low-privileged accounts do not have unnecessary permissions that could be leveraged during an attack. Continuous monitoring for anomalous API calls or unusual resource consumption patterns can help identify active exploitation attempts early, allowing security teams to respond before significant damage occurs.