CVE-2026-46840: Critical severity Oracle Oracle REST Data Services vulnerability
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46840?
CVE-2026-46840 has been classified with a critical severity score of 10.
What are the affected versions of CVE-2026-46840?
CVE-2026-46840 affects Oracle REST Data Services versions 24.2.0 through 26.1.0.
Who can exploit CVE-2026-46840?
An unauthenticated attacker with network access via HTTPS can exploit CVE-2026-46840.
What type of vulnerability is CVE-2026-46840?
CVE-2026-46840 is classified as an easily exploitable vulnerability in Backend-as-a-Service within Oracle REST Data Services.
How do I fix CVE-2026-46840?
To fix CVE-2026-46840, update Oracle REST Data Services to a version beyond 26.1.0.