CVE-2026-46829
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can cause a complete denial of service (DOS).
Risk Assessment
The attack can cause a hang or frequent crashes of the service, leading to system unavailability for users.
Recommendation
Apply patches provided by Oracle for versions 24.2.0-26.1.0 immediately and restrict network access to the service.
Other vulnerabilities in Oracle REST Data Services
See all- CVE-2026-46840Critical
Critical vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can compromise the service, potentially impacting other products (scope change).
- CVE-2026-46839Critical
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
- CVE-2026-46775Critical
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
- CVE-2026-46843Medium
Vulnerability in Oracle REST Data Services (component: Core) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, causing a partial denial of service (partial DOS).
- CVE-2026-46842Medium
Vulnerability in Oracle REST Data Services (Core component) versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can unauthorizedly update, insert, or delete data.
- CVE-2026-46841Medium
Vulnerability in Oracle REST Data Services (component: General) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, resulting in unauthorized read access to a subset of data.
- CVE-2026-46830Medium
Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can gain unauthorized read access to a subset of data. Affected versions are 24.2.0-26.1.0.
Original NVD description (English source)
Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).