Brief Summary: CVE-2026-46775 Oracle REST Data Services Core Component Takeover with Scope Change (CVSS 9.9)

Introduction

Oracle REST Data Services (ORDS) is the HTTPS gateway between external clients and the Oracle Database, which makes it one of the most sensitive pieces of the Oracle technology stack. It translates REST requests into database operations through an embedded JDBC driver. A newly disclosed vulnerability in the ORDS Core component, CVE-2026-46775, lets any low-privileged authenticated user take over the ORDS instance completely. The scope change then opens a path to compromising connected databases, APEX applications, and downstream services.

ORDS is a data service built on Java Enterprise Edition. It exposes more than 500 REST APIs for database administration and lifecycle management, runs on Oracle WebLogic Server, on Apache Tomcat, or in standalone mode, and powers Database Actions (formerly SQL Developer Web), the Oracle API for MongoDB, and pluggable database lifecycle operations. For organizations using Oracle Database in any capacity, ORDS is frequently the primary interface between their applications and their data.

This CVE is part of Oracle's May 2026 Critical Security Patch Update, which includes 11 security patches for ORDS alone. One of those vulnerabilities scores the maximum CVSS 10.0 and two score 9.9. That many critical fixes in a single patch cycle for one product stands out, and any organization running ORDS should review this release closely.

Technical Information

Vulnerability Characteristics

CVE-2026-46775 affects the Core component of Oracle REST Data Services, versions 24.2.0 through 26.1.0. The Core component is the central processing engine. It handles request routing, authentication, and privilege enforcement, and it translates REST requests into database operations. Oracle has not disclosed a CWE classification or the specific vulnerability mechanism, so we can describe the root cause only as far as the CVSS vector and the advisory language allow.

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

Oracle's risk matrix confirms that remote exploitation does not require an authentication bypass. The attacker needs at least low-level credentials, but nothing beyond that. The advisory calls the vulnerability "easily exploitable," a label that indicates no race conditions, special configurations, or exotic payloads are required.

ORDS Architecture and Attack Surface

This vulnerability is particularly dangerous because of where ORDS sits. ORDS is the HTTPS Web Gateway for Oracle Database, an alternative to Oracle HTTP Server and mod_plsql. It processes HTTP/HTTPS requests and translates them into database operations through an embedded JDBC driver, with no separate Oracle home required. The architecture relies on database users with highly restricted grants, which keep the middleware tier from executing operations beyond its defined scope.

ORDS supports several authentication mechanisms, including basic authentication, OAuth 2.0, and JSON Web Tokens (JWTs), and it integrates with OCI Identity and Access Management (IAM) for role-based access control.

Scope Change Analysis

Architecturally, the S:C (Scope Changed) designation is the most significant part of this vulnerability. Under the CVSS 3.1 specification, Scope Changed means the vulnerable component (ORDS Core) and the impacted component sit in different security authority domains. The NVD description says so directly: "While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services."

"Takeover" indicates the attacker gains full control of the ORDS instance. Through the scope change, these additional resources may also be compromised:

• Underlying Oracle Database instances connected via JDBC
• Applications consuming ORDS REST APIs
• Oracle APEX applications served through ORDS
• Database Actions (SQL Developer Web) functionality
• The Oracle API for MongoDB translation layer within ORDS
• Connected microservices and CI/CD pipeline integrations

When the gateway is compromised, so are the trust relationships it mediates. ORDS sits at a privilege boundary between untrusted network traffic and trusted database operations, and an attacker who takes over that boundary effectively controls what the database trusts.

Attack Flow

From the CVSS metrics and advisory details, the attack would proceed as follows:

1. The attacker obtains low-privileged credentials for an ORDS endpoint. Any authenticated account could work. Administrative privileges are not required.
2. The attacker crafts malicious HTTPS requests targeting the Core component. The low attack complexity (AC:L) and Oracle's "easily exploitable" designation indicate this does not require sophisticated payloads.
3. Successful exploitation results in takeover of the ORDS instance. The attacker gains full control over the Core component's request routing, authentication, and privilege enforcement.
4. Through the scope change, the attacker can use the compromised ORDS instance to impact connected database instances and downstream services that trust ORDS as a legitimate gateway.

Oracle does not publish detailed technical information about the vulnerability mechanism. It says it provides "the risk matrix information so that customers may conduct their own risk analysis." No proof-of-concept exploit code has been published, and no indicators of compromise specific to this CVE are available.

Companion Vulnerabilities in the May 2026 CSPU

CVE-2026-46775 is one of 11 ORDS vulnerabilities addressed in the May 2026 CSPU:

Seven of these 11 vulnerabilities may be remotely exploitable. The patch for CVE-2026-2332 also addresses CVE-2026-5795. The number and severity of these patches suggest ORDS has drawn concentrated vulnerability research. The Core component in particular appears to have systemic issues worth monitoring over the long term.

Affected Systems and Versions

Oracle REST Data Services versions 24.2.0 through 26.1.0 are affected. That covers every supported ORDS release in the range.

ORDS can be deployed in several configurations:

• Standalone mode
• On Oracle WebLogic Server
• On Apache Tomcat

Every deployment mode on an affected version is vulnerable, because the vulnerability is in the Core component, which all deployment topologies share. Any ORDS instance accessible over HTTPS from a network where an attacker holds low-privileged credentials is within the attack surface.

Vendor Security History

The ORDS Core component has a documented pattern of scope-change vulnerabilities across multiple Oracle patch cycles:

CVE-2025-30756 is a particularly relevant precedent. It allowed an unauthenticated attacker with network access via HTTP to compromise ORDS with scope change. The main difference is that CVE-2025-30756 required no authentication at all (PR:N), while CVE-2026-46775 requires low-privileged access (PR:L). Both involve scope change and can lead to complete system takeover. Together they point to a persistent class of vulnerability in which the trust boundary between the ORDS Core and backend databases can be exploited to push impact beyond the ORDS application itself.

Oracle's security posture outside ORDS has also been under pressure. In early 2025, Oracle confirmed a significant data breach affecting Oracle Cloud Infrastructure, with a threat actor claiming access to 6 million records, including single sign-on credentials, LDAP passwords, OAuth2 keys, and tenant data. CISA issued a security alert, and approximately 80 hospitals may have been affected through the Oracle Health data breach. In December 2025, threat actors were observed actively exploiting Oracle Identity Manager vulnerabilities (CVE-2026-21992). Those were REST web service vulnerabilities in Oracle Fusion Middleware, a pattern structurally similar to HTTPS-based attacks on ORDS.

Beginning in May 2026, Oracle moved from a quarterly Critical Patch Update cadence to a monthly Critical Security Patch Update release cycle. The change is designed to deliver faster protection against emerging threats, and it also signals that the tempo of threats against Oracle products has accelerated. Organizations should adjust their patch management schedules to match.

Threat Intelligence

As of the NVD publication date of May 28, 2026, there is no confirmed evidence of CVE-2026-46775 being actively exploited in the wild. The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, and no security vendor reports specifically reference active exploitation.

Several factors still raise the risk of exploitation:

Credential availability from prior breaches. The 2025 OCI breach resulted in stolen OAuth2 keys, SSO credentials, and LDAP passwords. These credentials could provide the low-privileged access (PR:L) that CVE-2026-46775 requires. Organizations that were affected by the OCI breach and have not rotated all credentials face compounded risk.

Active targeting of Oracle REST interfaces. The exploitation of Oracle Identity Manager REST web service vulnerabilities in late 2025 shows that threat actors are actively targeting Oracle's REST-facing middleware. Those attacks are structurally similar to HTTPS-based exploitation of ORDS.

Patch cluster reverse engineering risk. When 11 vulnerabilities in one product are disclosed at once, including three at CVSS 9.9 or above, the published patches themselves become a resource for threat actors. Differential analysis of pre- and post-patch binaries can reveal how a vulnerability works, and with this many critical fixes in one place, ORDS is a high-value target for that analysis.

No targeted detection capability. With no CWE classification, no disclosed vulnerability mechanism, and no published indicators of compromise, organizations cannot create targeted detection rules or WAF signatures. Exploitation is straightforward and targeted defense is difficult, and that imbalance weighs strongly in favor of immediate patching.

Mitigation Strategies

Apply the May 2026 CSPU

The definitive mitigation is to apply the May 2026 Critical Security Patch Update for Oracle REST Data Services. Oracle states that the CSPU "contains 11 new security patches" for ORDS and "Oracle strongly recommends customers apply patches without delay." It is the only remedy that addresses the root cause.

Interim Measures

For organizations that cannot patch immediately, Oracle's advisory offers general interim guidance: "blocking network protocols or removing privileges may help reduce risk, but these are not long term solutions."

The ORDS architecture suggests these more specific interim actions:

• Restrict HTTPS endpoint exposure. Deploy ORDS behind a reverse proxy or load balancer with strict access control lists, and expose it only to the internal networks that need it.
• Reduce authenticated accounts. The vulnerability requires low-privileged access, so cutting the number of accounts with any level of ORDS access directly shrinks the pool of potential attackers.
• Audit database user grants. ORDS documentation emphasizes that the architecture relies on database users with highly restricted grants. Verify that every database user account ORDS connects as has only the privileges it needs.
• Enforce strong authentication. Verify that no ORDS endpoint allows unauthenticated access that an attacker could use as a stepping stone, and enforce OAuth 2.0 or JWT authentication on all endpoints.
• Monitor access logs. Log HTTPS requests to ORDS endpoints and watch for anomalies, particularly low-privileged accounts behaving unusually, such as accessing administrative APIs.

Architectural Considerations

Scope-change vulnerabilities have recurred in the ORDS Core component across multiple patch cycles. That suggests the Core's position, as a gateway between external HTTPS requests and internal database operations, makes its privilege boundary inherently hard to defend. Organizations with high security requirements should evaluate whether additional isolation layers (network segmentation, dedicated ORDS instances per security zone, or database firewall products) can limit the blast radius of future ORDS Core vulnerabilities.

References

• NVD: CVE-2026-46775
• Oracle Security Critical Patch Update Advisory, May 2026
• Oracle Critical Patch Updates and Security Alerts
• Introduction to Oracle REST Data Services
• Oracle REST Data Services (ORDS) Product Page
• Oracle REST Data Services Best Practices
• NVD: CVE-2025-30756 (Prior ORDS Scope Change Vulnerability)
• CISA Vulnerability Summary, Week of July 14, 2025
• Oracle Critical Patch Update Advisory, April 2026
• Oracle Critical Patch Update Advisory, October 2025
• Threat Actors Actively Exploiting Oracle Identity Manager
• Threat Actor in Oracle Cloud Breach (CybersecurityDive)
• 80 Hospitals May Have Been Affected by Oracle Health Data Breach
• Hacker Linked to Oracle Cloud Intrusion Threatens to Sell Stolen Data