CVE-2026-46840: Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service)

Synopsis

This is a complete-takeover vulnerability in Oracle REST Data Services (ORDS), specifically in its Backend-as-a-Service component, affecting versions 24.2.0 through 26.1.0. An unauthenticated attacker with network access over HTTPS can reach the service directly, with no login or user interaction required, and the exploit is reliable with no special conditions needed. Successful exploitation gives the attacker full control of the ORDS instance and, due to a scope change in the CVSS rating, can significantly compromise other products that depend on or integrate with ORDS. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the ORDS service over the network via HTTPS; internet-exposed or internally routable deployments are directly at risk.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the attacker can send the exploit request anonymously.

• Victim interactionNot required

  No user action, click, or browser session is required; the attack is fully server-side.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable with no dependency on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• Attacker reads all data accessible to the ORDS process, including database credentials, API keys, and any application data served through the Backend-as-a-Service component.
• Attacker writes or deletes data through the ORDS interface, modifying database rows, stored procedures, or configuration artifacts.
• Attacker crashes or indefinitely degrades the ORDS service, taking down any applications that depend on it for REST-based data access.
• Because the CVSS scope changes, attacker-controlled ORDS can be used as a pivot point to compromise connected Oracle database instances or other integrated backend services.