CVE-2026-101380 Oracle Corporation CVE debrief

Who should care

Defenders and security teams responsible for Oracle REST Data Services instances, particularly those using versions 24.2.0 through 26.1.0, should assess their exposure and prioritize patching. This vulnerability may impact additional products due to its scope change potential, making it important for organizations using affected versions to take action.

Why it matters

CVE-2026-101380 is a medium-severity vulnerability in Oracle REST Data Services that allows low-privileged attackers with network access to potentially compromise the service and impact additional products. Defenders should assess exposure, particularly for versions 24.2.0 through 26.1.0, and prioritize patching due to potential data integrity and confidentiality impacts. The vulnerability requires human interaction, limiting but not eliminating its feasibility. Evidence from official sources supports these conclusions, but specific exploitation details or victim information is not provided.

• Potential unauthorized data modifications and access due to exploitation.
• Scope change impacts on additional products beyond Oracle REST Data Services.
• Requires verification of affected versions and exposure in the environment.
• Necessity for human interaction limits but does not eliminate attack feasibility.

Technical summary

The vulnerability, CVE-2026-101380, is in the ADP component of Oracle REST Data Services, affecting versions 24.2.0 through 26.1.0. It allows a low-privileged attacker with network access via HTTP to compromise the service. The vulnerability requires human interaction from a person other than the attacker and can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 Base Score is 5.4, indicating medium severity with Confidentiality and Integrity impacts.

Defensive priority

Medium priority for defenders to assess exposure and apply patches, given the potential for scope change and data integrity impacts.

Recommended defensive actions

• Assess exposure of Oracle REST Data Services instances, particularly versions 24.2.0 through 26.1.0.
• Apply patches or updates provided by Oracle Corporation as soon as possible.
• Monitor for suspicious activity or unauthorized access attempts on affected systems.
• Verify that human interaction requirements are met to mitigate attack complexity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, specific details on exploitation or victim organizations are not provided. Evidence from official sources supports these conclusions, but defenders should verify affected versions and exposure in their environment. The official CVE Program record (cve-org) and NIST NVD detail page (nvd) offer source-specific vulnerability assessments. The source item (source-item) provides additional CVE-2026-101380 details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.