CVE-2026-101494: High severity Oracle REST Data Services vulnerability

Q: Who is realistically exposed to this vulnerability?

Oracle REST Data Services deployments running supported affected versions 24.2.0 through 26.2.2 are exposed if they are reachable over HTTP by a low-privileged attacker with network access.

Q: What does an attacker need to exploit it?

An attacker needs network access to the Oracle REST Data Services HTTP interface and low-level privileges. No user interaction is required, and the attack complexity is low.

Q: What is the likely impact of successful exploitation?

Successful exploitation can give an attacker unauthorized access to critical data or complete access to all data accessible through Oracle REST Data Services. The vulnerability may also significantly affect additional products because it has scope change.

Published Oct 20, 2026

Updated

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Affected Software

1 affected component

Oracle REST Data Services>=24.2.0<=26.2.2

Event History

Oct 20, 2026

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverity

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

Oracle REST Data Services deployments running supported affected versions 24.2.0 through 26.2.2 are exposed if they are reachable over HTTP by a low-privileged attacker with network access.

What does an attacker need to exploit it?

An attacker needs network access to the Oracle REST Data Services HTTP interface and low-level privileges. No user interaction is required, and the attack complexity is low.

What is the likely impact of successful exploitation?

Successful exploitation can give an attacker unauthorized access to critical data or complete access to all data accessible through Oracle REST Data Services. The vulnerability may also significantly affect additional products because it has scope change.

CVE-2026-101494: High severity Oracle REST Data Services vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this vulnerability?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?