CVE-2026-46841: Oracle REST Data Services Unauthenticated Data Disclosure Vulnerability

Technical summary

CVE-2026-46841 is an information disclosure vulnerability in Oracle REST Data Services' General component. The vulnerability stems from improper access controls, allowing unauthenticated network-based attackers to bypass authentication mechanisms via HTTPS and read restricted data. The vulnerability affects a contiguous version range from 24.2.0 through 26.1.0, suggesting it was introduced or became exploitable at version 24.2.0 and persists through at least 26.1.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network accessibility, no special attack complexity, no privilege requirement, no user interaction, and localized scope with low confidentiality impact. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating authentication or authorization bypass logic.

Business impact

Data exposure in REST Data Services can compromise sensitive operational data that applications and dashboards rely on. If your organization uses REST Data Services to expose database content to internal or third-party consumers, an unauthenticated attacker can now read a subset of that data without detection by normal authentication logs. Depending on what data REST Data Services exposes in your environment, this could include personally identifiable information, financial records, configuration details, or other sensitive assets. The lack of integrity or availability impact means your data is not being deleted or modified—only read—but unauthorized disclosure of confidential information can trigger compliance violations (GDPR, HIPAA, SOC 2), regulatory penalties, and reputational harm. Organizations with strict data classification policies will need to treat this as a priority disclosure event.

Affected systems

Any organization running Oracle REST Data Services in versions 24.2.0, 24.3.x, 25.x, or 26.x (up to and including 26.1.0) is affected. REST Data Services is commonly deployed in enterprise environments to enable programmatic, HTTP-based access to Oracle Database objects (tables, views, procedures). Both on-premises and cloud-based deployments using these versions are vulnerable if they are network-accessible. Verify your installed version by checking the REST Data Services administration console or deployment logs.

Exploitability

This vulnerability is easily exploitable in real-world scenarios. An attacker with network access to the HTTPS endpoint (likely accessible from the internet if not properly firewalled) requires no credentials, no special tools, and no user interaction. The attack is deterministic—no race conditions or timing dependencies. However, exploitation is limited to reading a subset of available data; the attacker cannot access all stored data, cannot modify data, and cannot crash the service. The subset limitation suggests REST Data Services may have partial or role-based protections in place, but these have been bypassed for certain data. The lack of KEV status indicates this vulnerability has not yet been added to CISA's Known Exploited Vulnerabilities catalog, but that does not mean active exploits do not exist—it reflects the state of public disclosure and evidence of active exploitation as of the advisory date.

Remediation

Oracle has released patched versions of REST Data Services that address this vulnerability. The remediation pathway depends on your current version. Organizations on 24.2.0–25.x should upgrade to the next available stable release (verify against Oracle's official security advisory for the exact recommended version). Organizations on 26.x should upgrade to 26.1.1 or later (or the next published patch). Before upgrading, test the patched version in a staging environment to ensure compatibility with dependent applications. Consult Oracle's release notes for any breaking changes or configuration adjustments. In parallel, implement network segmentation to restrict HTTPS access to REST Data Services endpoints to only authorized internal clients, and consider enabling additional authentication layers (API keys, OAuth, certificate-based authentication) if REST Data Services supports them.

Patch guidance

1. Identify your current REST Data Services version (visible in the admin UI or logs). 2. Verify the patch availability from Oracle's security advisory—patches are typically released as point versions or patch sets. 3. Schedule a maintenance window and deploy the patched version to your staging environment. 4. Run automated integration tests to confirm REST Data Services continues to serve expected data and that dependent applications can still authenticate and connect. 5. Once validated, deploy to production. Oracle typically recommends testing patches before production deployment to avoid interruption. 6. After patching, re-test access controls to confirm the vulnerability is closed (attempt unauthenticated HTTPS requests to confirm they are rejected). Verify against Oracle's official patch release notes for precise version numbers.

Detection guidance

Organizations should implement the following detection measures: (1) Monitor HTTPS access logs for REST Data Services endpoints, looking for connections from unexpected IP addresses or without valid authentication tokens/session cookies. (2) Enable audit logging within REST Data Services (if available) to track data access requests and flag those without authenticated sessions. (3) Use a Web Application Firewall (WAF) to inspect HTTPS traffic to REST Data Services; flag requests that attempt to bypass authentication headers. (4) Baseline normal data request patterns and alert on anomalies in query volume or unusual data endpoints being accessed. (5) Search your network for any REST Data Services deployments using vulnerability scanning tools (e.g., Qualys, Nessus) to ensure all instances are tracked and patched. (6) If you have network segmentation, monitor attempts to reach REST Data Services from untrusted network zones.

Why prioritize this

While the CVSS score of 5.3 (Medium) is not in the critical range, this vulnerability warrants prioritization for three reasons: (1) It is easily exploitable—no credentials or special attack craft required, just network access. (2) It enables unauthorized data disclosure, which has regulatory and reputational consequences even if the data volume is a subset. (3) REST Data Services is a data-access layer; compromise of this component exposes the data governance model. Organizations should prioritize patching REST Data Services instances that are internet-facing or serve sensitive data (PII, financial records, configuration). Less critical instances (development, non-sensitive data) can follow standard patching schedules.

Risk score, explained

CVE-2026-46841 scores 5.3 in CVSS 3.1, placing it at the upper end of the Medium severity band. The score reflects: (1) Network accessibility (AV:N) – the vulnerability is easily reachable over HTTPS. (2) Low attack complexity (AC:L) – no special conditions or exploits required. (3) No authentication required (PR:N) – unauthenticated attackers can trigger it. (4) Localized confidentiality impact (C:L) – only a subset of data is exposed, not the entire database. (5) No integrity or availability impact (I:N, A:N) – data is not modified or deleted, and the service remains operational. The score does not approach critical (9.0+) or high (7.0–8.9) because the impact is read-only and partial, not full compromise or service disruption. However, the ease of exploitation and data disclosure risk justify urgent patching for sensitive environments.

Frequently asked questions