PT-2026-44531 · Oracle · Oracle Rest Data Services

Published 2026-05-28 · Updated 2026-06-13 · CVE-2026-46840

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle REST Data Services versions 24.2.0 through 26.1.0

Description An issue exists in the Backend-as-a-Service component of Oracle REST Data Services. An unauthenticated attacker with network access via HTTPS can exploit this flaw to compromise the system, potentially leading to a full takeover of Oracle REST Data Services. The attack may also significantly impact additional products due to a scope change.

Recommendations For versions 24.2.0 through 26.1.0, apply the available patch to resolve the issue.

Fix

Improper Access Control

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-284

CWE-287

CWE-306

Related Identifiers

CVE-2026-46840

Affected Products

Oracle Rest Data Services

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-46840 · Security Note
• https://oracle.com/security-alerts/cspumay2026.html · Vendor Advisory
• https://twitter.com/UpwindMDR/status/2060357947494940844 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2060143423508627835 · Twitter Post
• https://twitter.com/CCBalert/status/2060378567616123285 · Twitter Post
• https://twitter.com/OrizonCyber/status/2060111388916187437 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1tr2jqp/critical_takeover_vulnerability_discovered_in · Reddit Post
• https://twitter.com/integ_sec/status/2065785022829809843 · Twitter Post
• https://twitter.com/vuldb/status/2060349001044787631 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2062916140729258318 · Twitter Post
• https://t.me/cveNotify/165981 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2061779876772729318 · Twitter Post