CVE-2026-46839
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
Risk Assessment
The risk to the organization is very high (CVSS 9.9) – an attacker can gain full control over the service, leading to compromise of confidentiality, integrity, and availability of data and potentially other systems.
Recommendation
Immediately apply the patch provided by Oracle for Oracle REST Data Services. Restrict network access to the service to trusted hosts and users only.
Original NVD description (English source)
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).