CVE-2026-46839: Vulnerability in Oracle REST Data Services (component: Core)

Synopsis

A critical authentication-partial network vulnerability exists in the Core component of Oracle REST Data Services (ORDS), affecting versions 24.2.0 through 26.1.0. The flaw is reachable over HTTPS from any network location and requires only a low-privileged account to trigger; no victim interaction is needed. Successful exploitation gives an attacker full control of the ORDS instance and can cascade to compromise additional connected products, covering complete loss of confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ORDS service over the network via HTTPS; no local or physical access is assumed.

• AuthenticationRequired

  Any low-privileged account on the ORDS instance is sufficient; no administrative rights are needed.

• Victim interactionNot required

  No user action or social engineering is required; the attacker can trigger the vulnerability directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable without depending on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible through the ORDS instance, including database credentials, API tokens, and any application data exposed via REST endpoints.
• The attacker can write, modify, or delete persisted database rows and ORDS configuration, corrupting application state or planting backdoors.
• The ORDS service can be crashed or rendered completely unavailable, disrupting all dependent applications and database API consumers.
• Because the CVSS scope is marked as Changed, compromise can propagate to additional products connected to the same database or identity infrastructure beyond the ORDS process itself.