PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46842 Oracle Corporation CVE debrief

Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an unauthenticated integrity vulnerability in the Core component. The flaw allows remote attackers with network access via HTTPS to perform unauthorized data modification operations (update, insert, or delete) without authentication. The vulnerability is rated CVSS 3.1 Base Score 5.3 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, no user interaction, and low integrity impact with no confidentiality or availability impact. The CVE was published on May 28, 2026, with Oracle's Critical Patch Update for May 2026 serving as the authoritative source. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Oracle Corporation
Product
Oracle REST Data Services
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Oracle REST Data Services versions 24.2.0 through 26.1.0, particularly those with ORDS instances exposed to untrusted networks or the internet. Database administrators, application security teams, and Oracle middleware operators responsible for ORDS deployment and patch management should prioritize this advisory.

Technical summary

The vulnerability exists in Oracle REST Data Services Core component across versions 24.2.0-26.1.0. An unauthenticated attacker can send HTTPS requests to compromise data integrity through unauthorized update, insert, or delete operations. The attack requires no user interaction and no privileges, with low complexity for exploitation. The scope is unchanged, affecting only the vulnerable ORDS component without impacting other resources. Confidentiality and availability are not affected per the CVSS vector.

Defensive priority

medium

Recommended defensive actions

  • Apply Oracle Critical Patch Update for May 2026 to affected ORDS installations
  • Upgrade Oracle REST Data Services to a patched version beyond 26.1.0
  • Review ORDS deployment architecture to ensure HTTPS endpoints are not unnecessarily exposed to untrusted networks
  • Implement network segmentation to restrict ORDS HTTPS access to authorized administrative hosts where feasible
  • Monitor ORDS access logs for anomalous data modification patterns from unexpected source addresses
  • Validate database audit configurations to capture unauthorized DML operations that may indicate exploitation attempts

Evidence notes

The vulnerability description indicates 'easily exploitable' conditions with unauthenticated network access via HTTPS as the attack vector. Integrity impacts are limited to 'some' accessible data rather than complete system compromise. The CVSS scoring reflects a focused integrity-only impact with no confidentiality breach or service disruption capability.

Official resources

Oracle disclosed this vulnerability through its Critical Patch Update (CPU) advisory for May 2026. The affected component is the Core module of Oracle REST Data Services, with supported versions 24.2.0 through 26.1.0 confirmed vulnerable.