Oracle REST Data Services: Vulnerability allowing takeover via HTTP
Summary
A flaw in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 allows an attacker with network access over HTTP and a low-privileged account to compromise the service. Successful exploitation can result in a takeover of ORDS with high impact on confidentiality, integrity and availability, and requires no user interaction. Oracle has published fixes in its October 2026 Critical Patch Update.
Affected
- Oracle REST Data Services 24.2.0 through 26.2.2
- Attacker requires network access via HTTP and a low-privileged account
Fixed in
- Unknown. The patched ORDS release is not named in the sources reviewed; check the Oracle October 2026 Critical Patch Update advisory.
Workaround
- No vendor workaround known. Patching is the only documented remedy.
- Interim measures: restrict network access to ORDS HTTP endpoints, reduce accounts that can authenticate to ORDS, monitor ORDS logs for unusual activity.
Exploitation
- No evidence of exploitation in the wild. Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- No public proof of concept found.
- EPSS 0.00389.
Our recommendation
- Identify all ORDS installations and whether they are internet-facing or have many user accounts.
- Apply the October 2026 Oracle Critical Patch Update to ORDS as a priority where exposure is high; otherwise include it in the normal patch cycle.
- Until patched, restrict network access to ORDS HTTP endpoints and review accounts with ORDS access.
- Monitor ORDS logs for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 Critical Patch Update www.oracle.com
- VulDB: CVE-2026-91610 vuldb.com
- OpenCVE: CVE-2026-91610 app.opencve.io
- Vulners: CVE-2026-91610 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:21.
Original description (NVD)
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.