PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46775 Oracle Corporation CVE debrief

A critical vulnerability in Oracle REST Data Services (ORDS) allows low-privileged attackers with network access to achieve complete system takeover. The vulnerability affects versions 24.2.0 through 26.1.0 and carries a CVSS 3.1 score of 9.9 due to its network attack vector, low complexity, and scope change to additional products. Successful exploitation enables full confidentiality, integrity, and availability compromise. The vulnerability was disclosed by Oracle in their May 2026 Critical Patch Update.

Vendor
Oracle Corporation
Product
Oracle REST Data Services
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations running Oracle REST Data Services 24.2.0-26.1.0; database administrators managing Oracle Database deployments with REST API exposure; security teams responsible for Oracle Critical Patch Update cycles; cloud architects using ORDS in multi-tenant or shared database environments where scope change impacts could cascade to other services

Technical summary

The vulnerability resides in the Core component of Oracle REST Data Services versions 24.2.0-26.1.0. Attackers with low privileges and HTTPS network access can exploit this flaw to compromise ORDS completely. The CVSS scope change metric (S:C) indicates that successful attacks may significantly impact additional products beyond ORDS itself, suggesting potential for lateral movement or trust boundary violations in connected Oracle database environments.

Defensive priority

critical

Recommended defensive actions

  • Apply Oracle Critical Patch Update for May 2026 immediately to affected ORDS installations
  • Upgrade Oracle REST Data Services to a patched version beyond 26.1.0
  • Review and restrict network access to ORDS endpoints to authorized sources only
  • Audit ORDS deployments for unauthorized configuration changes or unexpected administrative accounts
  • Monitor Oracle security alerts for additional guidance on this vulnerability
  • Conduct impact assessment given the scope change indicator—evaluate connected systems that may be affected through compromised ORDS instances

Evidence notes

Vendor identification relies on reference domain analysis (oracle.com) with low confidence flag for review. The vulnerability description is sourced directly from NVD/CVE.org records. CVSS vector confirms scope change (S:C) indicating impact beyond the vulnerable component.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46775 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46775

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46775 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46775

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.