CVE-2026-46839

An attacker with minimal network privileges (low privileged) can exploit the vulnerability through the HTTPS protocol without requiring any user interaction. The vulnerability is easy to exploit (Attack Complexity: Low), and its scope extends beyond the product itself (scope change), which means that a successful attack can also compromise other systems or Oracle services cooperating with ORDS. The detailed technical mechanism was not disclosed in the vendor's description.

Successful exploitation of the vulnerability leads to complete takeover of the Oracle REST Data Services instance, including breach of confidentiality, integrity, and availability of data and services. The attack may additionally significantly affect additional products integrated with ORDS.

Patches available from the vendor described in the Oracle Critical Patch Update bulletin from May 2026 should be applied as soon as possible (https://www.oracle.com/security-alerts/cspumay2026.html). Until the update is applied, it is recommended to limit access to the ORDS service only to trusted networks and to verify the permissions of accounts that can connect to the service via HTTPS.

Oracle REST Data Services (ORDS) in versions 24.2.0 through 26.1.0 (inclusive)