External risk intelligence

Oracle REST Data Services Compromise Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-46839

A critical vulnerability exists in Oracle REST Data Services, a service that connects web browsers to Oracle databases, which could allow a low-privileged attacker with network access to completely compromise the service and potentially affect other products. This could impact confidentiality, integrity, and availabili

4Halo Surface Signal

Oracle Rest Data Services

24.2.0 to 26.1.0

External exposure likelihood

Halo Surface Signal score for CVE-2026-46839

Oracle REST Data Services acts as a bridge between web browsers and Oracle databases. It is commonly deployed as an internet-facing API or web service to facilitate data access, making it a standard component for public-facing application connectivity.

PCI scan relevance

PCI Relevance for CVE-2026-46839

Yes

CVE-2026-46839 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This vulnerability in Oracle REST Data Services allows a low-privileged attacker to take over the service, which is likely to cause a PCI ASV scan failure.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle REST Data Services, a component that bridges web browsers and Oracle databases, often used for public-facing application connectivity. This issue, if exploited by a low-privileged attacker, could lead to a full takeover of the service and potentially impact other connected products due to its network accessibility via HTTPS.

  • Attackers can take over Oracle's data services.
  • It affects systems that connect applications to databases.
  • Confirming relevance and exposure is the key action.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges can exploit this vulnerability by accessing Oracle REST Data Services over a network. The vulnerability in the Core component of Oracle REST Data Services can lead to a complete takeover of the service, potentially impacting other connected products.

  • Network access required.
  • Vulnerable component: Core.
  • Risk: Service takeover.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access could compromise Oracle REST Data Services, potentially impacting other products. This vulnerability could allow for a complete takeover of the Oracle REST Data Services, affecting confidentiality, integrity, and availability.

  • Oracle REST Data Services
  • Network access via HTTPS
  • Takeover of service

Priority actions

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely falls to teams managing Oracle applications and their underlying infrastructure. The first practical step is to identify all instances of Oracle REST Data Services, determine their network accessibility and business criticality, and then locate the accountable owners. This information is crucial for prioritizing remediation efforts and planning subsequent actions, which may involve vendor coordination or temporary risk reduction measures.

  • Identify affected Oracle REST Data Services instances.
  • Verify network reachability and business criticality.
  • Plan targeted remediation based on ownership and risk.

Frequently asked questions

What is Oracle REST Data Services and what is it used for?

Oracle REST Data Services (ORDS) acts as a bridge between web browsers and Oracle databases. It is commonly used to enable public-facing applications to connect to and interact with Oracle databases by providing web service APIs.

What type of vulnerability is CVE-2026-46839 in Oracle REST Data Services?

CVE-2026-46839 is a critical vulnerability classified as CWE-284 (Improper Access Control). It allows a low-privileged attacker with network access to compromise the Oracle REST Data Services.

What are the conditions for an attacker to exploit this CVE?

An attacker needs network access via HTTPS to exploit this vulnerability. Crucially, the attacker only requires low privileges, and no user interaction is needed for exploitation. The vulnerability is not triggered if the attacker lacks network access or sufficient privileges.

Who should be concerned about this vulnerability, considering its exposure?

Organizations running Oracle REST Data Services that are accessible from the internet should be concerned. Halo classifies this as an external threat because it can be exploited over the network, potentially impacting public-facing applications and services.

What is the first step for teams running Oracle REST Data Services?

The initial step is to identify all instances of Oracle REST Data Services within your environment. You should then determine their network accessibility and their importance to business operations to plan for remediation.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished Modified