CVE-2026-46842
published 2026-05-28CVE-2026-46842: Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.18%
8.0th percentile
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | rest_data_services | 24.2.0 – 26.1.0 | — |
| oracle_corporation | oracle_rest_data_services | 24.2.0 – 26.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle REST Data Services up to 26.1.0 Core improper authorization (EUVD-2026-33020)
vuldb·2026-05-28·CVSS 5.3
CVE-2026-46842 [MEDIUM] Oracle REST Data Services up to 26.1.0 Core improper authorization (EUVD-2026-33020)
A vulnerability was found in Oracle REST Data Services up to 26.1.0 and classified as critical. This vulnerability affects unknown code of the component Core. The manipulation results in improper authorization.
This vulnerability is known as CVE-2026-46842. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-rhq4-mw8x-m742: Vulnerability in Oracle REST Data Services (component: Core)
ghsa_unreviewed·2026-05-28
CVE-2026-46842 [MEDIUM] CWE-284 GHSA-rhq4-mw8x-m742: Vulnerability in Oracle REST Data Services (component: Core)
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-28
Published