CVE-2026-91609

Vulnerability in Oracle REST Data Services (Core component) versions 24.2.0-26.2.2. An easily exploitable HTTP attack by a low-privileged attacker can result in unauthorized access to critical data or all data accessible through Oracle REST Data Services.

Vulnerability in Oracle REST Data Services (component: Core) affecting versions 24.2.0-26.2.1. A low-privileged attacker with network access via HTTP can perform unauthorized update, insert or delete operations and gain unauthorized read access to a subset of data.

Vulnerability in Oracle REST Data Services (ADP component) affecting versions 24.2.0-26.1.0. A low-privileged authenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access and unauthorized read access, requiring human interaction and potentially impacting additional products.

Vulnerability in Oracle REST Data Services (ADP component) affecting versions 24.2.0-26.1.0. A low-privileged authenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access to data accessible through the service.

Vulnerability in Oracle REST Data Services (Database Actions component), affected versions 24.2.0-26.1.0. An easily exploitable flaw allows a high-privileged attacker with HTTP network access to cause a partial denial of service.

Vulnerability in Oracle REST Data Services (Database Actions component) affecting versions 24.2.0-26.1.0. A high-privileged attacker with network access via HTTP can cause unauthorized update, insert, or delete access, unauthorized read access, and partial denial of service.

Vulnerability in Oracle REST Data Services (Database Actions component) affecting versions 24.2.0-26.1.0. A low-privileged authenticated attacker with network access via HTTP can cause unauthorized update, insert, or delete access, unauthorized read access, and partial denial of service.

Vulnerability in Oracle REST Data Services (Backend-as-a-Service component) affecting versions 24.2.0-26.1.0. An unauthenticated attacker with network access via HTTP can, under difficult conditions, cause unauthorized creation, deletion, or modification of critical data.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. An easily exploitable flaw allows a high-privileged attacker with HTTP network access, requiring user interaction, to update, insert or delete some data.

Vulnerability in Oracle REST Data Services (Core component), affected versions 24.2.0-26.1.0. A difficult-to-exploit flaw allows an unauthenticated attacker with HTTP network access to read a subset of service data.