CVE-2026-101374: Medium severity Oracle REST Data Services vulnerability

Q: Which deployments are exposed to this issue?

Oracle REST Data Services deployments using the Backend-as-a-Service component in supported versions 24.2.0 through 26.1.0 are affected. An attacker can reach the vulnerable component over HTTP from the network.

Q: Does exploitation require an account or user interaction?

No. The vulnerability is exploitable by an unauthenticated attacker and does not require user interaction, although Oracle rates exploitation as difficult due to high attack complexity.

Q: What could a successful attacker do?

A successful attack can allow unauthorized creation, deletion, or modification of critical data or of all data accessible through Oracle REST Data Services. The reported impact is integrity-only; no confidentiality or availability impact is specified.

Published Oct 20, 2026

Updated

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Affected Software

1 affected component

Oracle REST Data Services>=24.2.0<=26.1.0

Event History

Oct 20, 2026

CVE Published

via MITRE·09:20 PM

Data Sourced

via MITRE·09:20 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this issue?

Oracle REST Data Services deployments using the Backend-as-a-Service component in supported versions 24.2.0 through 26.1.0 are affected. An attacker can reach the vulnerable component over HTTP from the network.

Does exploitation require an account or user interaction?

No. The vulnerability is exploitable by an unauthenticated attacker and does not require user interaction, although Oracle rates exploitation as difficult due to high attack complexity.

What could a successful attacker do?

A successful attack can allow unauthorized creation, deletion, or modification of critical data or of all data accessible through Oracle REST Data Services. The reported impact is integrity-only; no confidentiality or availability impact is specified.

CVE-2026-101374: Medium severity Oracle REST Data Services vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require an account or user interaction?

What could a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require an account or user interaction?

What could a successful attacker do?