CVE-2026-46775: Vulnerability in Oracle REST Data Services (component: Core)

Synopsis

An authentication-bypass-level privilege escalation vulnerability exists in the Core component of Oracle REST Data Services (ORDS), affecting versions 24.2.0 through 26.1.0. The flaw is reachable over HTTPS from any network with only a low-privileged account required, and no interaction from another user is needed. Successful exploitation results in full takeover of the ORDS instance, with high impact to confidentiality, integrity, and availability, and a scope change that can affect additional dependent products. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ORDS service over the network via HTTPS; no local or physical access is needed.

• AuthenticationRequired

  Any low-privileged account is sufficient; the attacker does not need administrator or elevated credentials to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race conditions, or memory-layout preparation.

Blast Radius

• A successful attacker gains full control of the Oracle REST Data Services instance, reading all data served through the ORDS Core component including stored credentials, session tokens, and application records.
• The attacker can modify or delete persisted data exposed via ORDS, corrupting database-backed applications that depend on it.
• The attacker can crash or render the ORDS service unavailable, disrupting any application or API layer that relies on it.
• Because the CVSS scope is changed, compromise can extend to additional products and services connected to the affected ORDS deployment, beyond the initial target.