CVE-2026-35277: High severity Oracle Oracle REST Data Services vulnerability
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle REST Data Services HTTPS endpoints: place the service behind a firewall/reverse proxy or VPN, limit inbound access to trusted IP addresses, and/or deploy a Web Application Firewall to block exploit attempts. This mitigates the reported attack vector of a low-privileged attacker with network access via HTTPS.
- Operational
Audit Oracle REST Data Services logs and data for signs of compromise (unauthorized creation, deletion, or modification). Review recent changes, validate data integrity, and restore affected data from backups if unauthorized modifications are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35277?
The severity of CVE-2026-35277 is high with a score of 8.1.
How do I fix CVE-2026-35277?
To mitigate CVE-2026-35277, you should upgrade to a version of Oracle REST Data Services that is not affected, specifically versions beyond 26.1.0.
What component is affected by CVE-2026-35277?
CVE-2026-35277 affects the Core component of Oracle REST Data Services.
What versions of Oracle REST Data Services are affected by CVE-2026-35277?
Supported versions of Oracle REST Data Services affected by CVE-2026-35277 are from 24.2.0 to 26.1.0.
Who can exploit CVE-2026-35277?
CVE-2026-35277 can be exploited by a low privileged attacker with network access via HTTPS.