CVE-2026-101378: Medium severity Oracle Oracle REST Data Services vulnerability

Q: Who can exploit this issue?

An attacker needs network access to the affected Oracle REST Data Services instance over HTTP and low-level privileges. No user interaction is required.

Q: What is the potential impact of a successful attack?

A successful attack can allow unauthorized update, insert, or delete operations on some data accessible through Oracle REST Data Services. The stated impact is limited to integrity; no confidentiality or availability impact is identified.

Q: Which deployments should be prioritized for remediation?

Prioritize Oracle REST Data Services installations using the ADP component on supported affected versions from 24.2.0 through 26.1.0, especially instances reachable over the network by low-privileged users.

Published Oct 20, 2026

Updated

Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

Affected Software

1 affected component

Oracle Oracle REST Data Services>=24.2.0<=26.1.0

Event History

Oct 20, 2026

CVE Published

via MITRE·09:20 PM

Data Sourced

via MITRE·09:20 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this issue?

An attacker needs network access to the affected Oracle REST Data Services instance over HTTP and low-level privileges. No user interaction is required.

What is the potential impact of a successful attack?

A successful attack can allow unauthorized update, insert, or delete operations on some data accessible through Oracle REST Data Services. The stated impact is limited to integrity; no confidentiality or availability impact is identified.

Which deployments should be prioritized for remediation?

Prioritize Oracle REST Data Services installations using the ADP component on supported affected versions from 24.2.0 through 26.1.0, especially instances reachable over the network by low-privileged users.

CVE-2026-101378: Medium severity Oracle Oracle REST Data Services vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of a successful attack?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact of a successful attack?

Which deployments should be prioritized for remediation?