CVE-2026-46843
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vulnerability in Oracle REST Data Services (component: Core) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, causing a partial denial of service (partial DOS).
Risk Assessment
The risk is that an unauthenticated attacker can disrupt the availability of REST Data Services, potentially impacting applications relying on these services.
Recommendation
Apply the patches provided by Oracle for affected versions (24.2.0-26.1.0) immediately and monitor systems for exploitation attempts.
Other vulnerabilities in Oracle REST Data Services
See all- CVE-2026-46840Critical
Critical vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can compromise the service, potentially impacting other products (scope change).
- CVE-2026-46839Critical
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
- CVE-2026-46775Critical
A critical vulnerability in Oracle REST Data Services (versions 24.2.0-26.1.0) allows a low-privileged attacker with network access via HTTPS to take over the service. The attack may impact additional products (scope change).
- CVE-2026-46842Medium
Vulnerability in Oracle REST Data Services (Core component) versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can unauthorizedly update, insert, or delete data.
- CVE-2026-46841Medium
Vulnerability in Oracle REST Data Services (component: General) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTPS can easily exploit this flaw, resulting in unauthorized read access to a subset of data.
- CVE-2026-46830Medium
Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can gain unauthorized read access to a subset of data. Affected versions are 24.2.0-26.1.0.
- CVE-2026-46829High
Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can cause a complete denial of service (DOS).
Original NVD description (English source)
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).