CVE-2026-46840: oracle corporation oracle rest data services Improper Access Control

Vulnerability summary

CVE-2026-46840 is a critical (CVSS 10.0) Improper Access Control vulnerability in oracle corporation oracle rest data services. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities.

Timeline

1. 28-05-2026
   PublishedVulnerability first disclosed.
2. 29-05-2026
   Last modifiedVulnerability information updated.

Description

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.