CVE-2026-35277: Vulnerability in Oracle REST Data Services (component: Core)

Synopsis

An access-control vulnerability in the Core component of Oracle REST Data Services (versions 24.2.0 through 26.1.0) allows a low-privileged attacker to reach the service over HTTPS and bypass authorization checks. Successful exploitation gives the attacker full read access to all data the service can reach, plus the ability to create, modify, or delete critical records. No fix version has been published; HarborGuard tracks the Oracle advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle REST Data Services endpoint over the network via HTTPS; the service does not need to be internet-facing, but it must be reachable from the attacker's position.

• AuthenticationRequired

  Any low-privilege account with network access is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No user interaction is needed; the attacker operates entirely against the service without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, timing windows, or environmental prerequisites.

Blast Radius

• Reads all data accessible through Oracle REST Data Services, including database rows, stored credentials, and any sensitive application data exposed via REST endpoints.
• Creates, modifies, or deletes critical data records persisted in the underlying Oracle database schemas served by the component.
• Scope of impact is limited to confidentiality and integrity; the service itself is not crashed and availability is not directly affected.