CVE-2026-101385: Medium severity Oracle REST Data Services vulnerability

Q: Who can exploit this vulnerability?

An attacker must already have high privileges and network access to the affected Oracle REST Data Services instance over HTTP. No user interaction is required.

Q: Which deployments are affected?

Affected supported versions are Oracle REST Data Services 24.2.0 through 26.1.0. The provided information does not state whether any particular default configuration changes exposure.

Q: What is the potential impact of successful exploitation?

A successful attack can allow unauthorized creation, deletion, or modification of critical data, or of all data accessible through Oracle REST Data Services. The reported CVSS impact is limited to integrity; no confidentiality or availability impact is specified.

Published Oct 20, 2026

Updated

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).

Affected Software

1 affected component

Oracle REST Data Services>=24.2.0<=26.1.0

Event History

Oct 20, 2026

CVE Published

via MITRE·09:20 PM

Data Sourced

via MITRE·09:20 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already have high privileges and network access to the affected Oracle REST Data Services instance over HTTP. No user interaction is required.

Which deployments are affected?

Affected supported versions are Oracle REST Data Services 24.2.0 through 26.1.0. The provided information does not state whether any particular default configuration changes exposure.

What is the potential impact of successful exploitation?

A successful attack can allow unauthorized creation, deletion, or modification of critical data, or of all data accessible through Oracle REST Data Services. The reported CVSS impact is limited to integrity; no confidentiality or availability impact is specified.

CVE-2026-101385: Medium severity Oracle REST Data Services vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are affected?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which deployments are affected?

What is the potential impact of successful exploitation?