Introduction
Oracle's first monthly Critical Security Patch Update (CSPU), for May 2026, addresses 11 vulnerabilities in Oracle REST Data Services alone. CVE-2026-35277 has a particularly accessible attack path. A low-privileged user with nothing more than basic HTTPS access can read, create, delete, or modify critical data across the entire ORDS deployment. For organizations running any ORDS version from 24.2.0 through 26.1.0, which covers roughly two years of releases, this vulnerability exposes the primary gateway between web clients and Oracle Database to unauthorized data operations.
Oracle REST Data Services (ORDS) is a Java EE-based HTTPS web gateway that sits in front of Oracle Database and provides RESTful API access to database operations. It powers Oracle APEX applications, Database Actions (the web-based administration interface), and more than 500 REST APIs covering PDB lifecycle management, performance monitoring, security administration, data dictionary access, and data pump operations. ORDS can be deployed on Oracle WebLogic Server, Apache Tomcat, or in standalone mode. That flexibility has made it a fixture of Oracle Database environments in enterprises worldwide.
Technical information
Vulnerability profile
CVE-2026-35277 targets the Core component of Oracle REST Data Services. The Core component is the central Java EE implementation responsible for command-line configuration, enhanced security, file caching, and the delivery of RESTful web services. It is the foundational layer through which all ORDS operations flow.
The vulnerability carries a CVSS 3.1 Base Score of 8.1 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. No CWE ID has been assigned, which limits how precisely it can be classified against standard weakness enumeration frameworks. Oracle has not disclosed the specific mechanism, in line with its policy of withholding exploitation details until customers have had the opportunity to patch.
CVSS vector decomposition
Each metric in the vector describes part of the attack surface:
| CVSS Metric | Value | Security Implication |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely, with no physical or local access required |
| Attack Complexity (AC) | Low | No specialized conditions needed, so exploitation is straightforward |
| Privileges Required (PR) | Low | Only low-privilege credentials needed, not administrative access |
| User Interaction (UI) | None | Fully automated attack possible, with no user action required |
| Scope (S) | Unchanged | Impact confined to the ORDS component itself |
| Confidentiality (C) | High | Complete access to all ORDS-accessible data |
| Integrity (I) | High | Unauthorized creation, deletion, or modification of critical data |
| Availability (A) | None | No impact on service availability |
Oracle's risk matrix confirms that the vulnerability "cannot be exploited remotely without authentication," so an attacker needs some level of credentials. The bar is low, though. Low-privilege credentials are enough, and administrative access is not required.
Attack flow analysis
Based on the CVSS characteristics and the architecture of ORDS, we can outline the likely attack flow:
-
The attacker obtains low-privilege credentials for an ORDS deployment. These could come from credential stuffing, phishing, insider access, or any other way of acquiring credentials. They only need to grant basic authenticated access to the ORDS HTTPS endpoint.
-
The attacker sends crafted HTTPS requests to the ORDS Core component that bypass or exceed the intended authorization boundaries of the low-privilege account. Because the attack uses the same HTTPS protocol as legitimate ORDS traffic, it is difficult to distinguish from normal operations at the network layer.
-
Successful exploitation gives the attacker unauthorized read access to all ORDS-accessible data (High confidentiality impact) and the ability to create, delete, or modify critical data (High integrity impact). ORDS is the gateway to Oracle Database operations across more than 500 REST APIs, so the reachable data could be extensive.
-
The attack does not disrupt the service, so it can run silently without triggering availability-based alerts.
With HTTPS as the attack protocol, low complexity, and no user interaction, this vulnerability could be exploited programmatically and at scale against any exposed ORDS endpoint where the attacker holds valid low-privilege credentials.
Context within the May 2026 CSPU
CVE-2026-35277 is one of 11 ORDS vulnerabilities addressed in the May 2026 CSPU, and seven of those are remotely exploitable without authentication. The full set of ORDS CVEs in this update includes:
| CVE | CVSS | Component | Privileges Required | Key Impact |
|---|---|---|---|---|
| CVE-2026-46840 | 10.0 | Backend as a Service | None | Full takeover with scope change |
| CVE-2026-46839 | 9.9 | Core | Low | Takeover with scope change |
| CVE-2026-46775 | 9.9 | Core | Low | Takeover with scope change |
| CVE-2026-35277 | 8.1 | Core | Low | Unauthorized data access and modification |
| CVE-2026-35266 | 7.9 | Core | Low | Full data compromise, partial DoS |
| CVE-2026-46829 | 7.5 | Mongoapi | None | Complete denial of service |
| CVE-2026-46843 | 5.3 | Core | None | Partial denial of service |
| CVE-2026-46842 | 5.3 | Core | None | Unauthorized update/insert/delete |
| CVE-2026-46841 | 5.3 | General | None | Unauthorized read access |
| CVE-2026-46830 | 5.3 | Mongoapi | None | Unauthorized read access |
Two CVSS 9.9 vulnerabilities and one CVSS 10.0 vulnerability in the same component family suggest systemic problems in the ORDS authorization and access control architecture rather than an isolated defect. Organizations that fix CVE-2026-35277 on its own risk staying exposed to the more severe CVE-2026-46839 and CVE-2026-46840.
Deployment topology considerations
ORDS supports three deployment topologies: Oracle WebLogic Server, Apache Tomcat, and standalone mode. All three are potentially affected, because the vulnerability is in the Core component, which every deployment configuration shares. Organizations should inventory every ORDS deployment, whatever application server it runs on.
Affected systems and versions
All supported Oracle REST Data Services versions from 24.2.0 through 26.1.0 are affected. That range covers approximately two years of releases and every currently supported ORDS version.
Affected deployment configurations include:
- ORDS deployed on Oracle WebLogic Server
- ORDS deployed on Apache Tomcat
- ORDS deployed in standalone mode
Any ORDS instance in the affected version range that is reachable over HTTPS and has low-privilege user accounts is potentially vulnerable.
Vendor security history
Oracle's security posture around ORDS shifted significantly in 2026, as the vulnerability counts show:
| Year | ORDS Vulnerabilities | Average CVSS | Notable Pattern |
|---|---|---|---|
| 2026 (through May) | 10 | 7.45 | Surge in volume and severity, including CVSS 9.9 and 10.0 |
| 2025 | 1 | 6.1 | Single vulnerability (CVE-2025-30756) |
| 2021 | 12 | 5.58 | Dominated by third-party components (jQuery, Jetty, SheetJS) |
| 2020 | 4 | 5.63 | Mix of Jetty and Oracle native vulnerabilities |
| 2019 | 4 | 6.10 | Third-party libraries (Jetty, jQuery, Hibernate) |
The jump from 1 vulnerability to 10 is a 900% increase, and average severity rose by 1.35 CVSS points over 2025. The 2026 vulnerabilities are also concentrated in Oracle-native Core component issues, not the third-party library vulnerabilities that dominated earlier years. The shift correlates with ORDS's expanded role as the primary HTTPS gateway and its broadening API surface.
Across the broader Oracle portfolio, 2026 CPUs have already addressed 337 vulnerabilities. Oracle has also faced cloud security incidents, including a breach attributed to a threat actor known as "rose87168" that allegedly compromised approximately 6 million records from Oracle's legacy Gen 1 cloud servers.
Oracle products have a documented history of targeted exploitation by sophisticated threat actors. SLCyber research demonstrated that CVE-2021-35587 in Oracle Identity Manager was exploited for pre-authentication remote code execution and data exfiltration. Oracle vulnerabilities remain viable targets when organizations delay patching. The Clop ransomware group has also run data extortion campaigns against Oracle E-Business Suite deployments.
With the May 2026 CSPU, Oracle moves from quarterly Critical Patch Updates to monthly Critical Security Patch Updates. The faster cadence cuts the exposure window from approximately 90 days to 30 days but adds to the operational burden on Oracle administrators. Organizations will need to adapt their patch management workflows to monthly cycles starting with the June 2026 CSPU.
Mitigation guidance
The definitive remediation for CVE-2026-35277 is applying the May 2026 Critical Security Patch Update. ORDS follows a version-based upgrade model, and Oracle releases no separate patches for it. Administrators must download the latest ORDS version and install it, which upgrades the existing installation.
Oracle strongly recommends applying patches without delay. It notes that attackers have historically targeted systems that remain unpatched after security fixes are released.
For organizations that cannot immediately apply the CSPU, the following compensating controls are worth considering:
- Audit low-privilege ORDS accounts: Exploitation requires low-privilege credentials, so keep the number of active accounts with ORDS access to a minimum. Disable or suspend accounts that do not need ORDS.
- Network segmentation: Limit HTTPS access to ORDS endpoints to trusted internal networks. Put ORDS behind web application firewalls or reverse proxies that can inspect and filter HTTPS requests to the Core component.
- Enhanced monitoring: Log all HTTPS requests to ORDS Core REST APIs in detail. Look for low-privilege accounts whose requests exceed their expected data access or modification patterns. The attack has no availability impact, so exploitation will not trigger uptime alerts, and data access monitoring is essential.
- Apply the full CSPU: This update fixes 11 ORDS vulnerabilities, seven of them remotely exploitable without authentication, so partial remediation leaves critical gaps. The CVSS 9.9 and 10.0 vulnerabilities in the same update are more severe than CVE-2026-35277 and should not be overlooked.
References
- NVD Entry for CVE-2026-35277
- Oracle Security Critical Patch Update Advisory, May 2026
- Oracle Critical Patch Updates and Security Alerts
- Introduction to Oracle REST Data Services (ORDS 24.2 Documentation)
- Oracle REST Data Services 26.1 Documentation
- Oracle REST Data Services Security Vulnerabilities in 2026 (Stack.Watch)
- Oracle Community Forums: Patches for ORDS?
- CISA Known Exploited Vulnerabilities Catalog
- NJCCIC 2026 Cyber Threat Assessment
- CVE-2025-30756 Detail (Prior ORDS Vulnerability)
- SLCyber: Uncovering Oracle Identity Manager Pre Auth RCE
- DB-Engines Database Popularity Ranking
- Oracle REST Data Services Product Page
