Oracle REST Data Services CVE-2026-46840: Overview of a CVSS 10.0 Unauthenticated Takeover Vulnerability

Introduction

CVE-2026-46840 is a maximum-severity (CVSS 10.0) vulnerability in Oracle REST Data Services. It lets unauthenticated attackers fully take over ORDS instances via HTTPS. The scope change is confirmed, so connected Oracle Databases and downstream applications are also at risk. Oracle disclosed it on May 28, 2026, as part of its first-ever Critical Security Patch Update (CSPU). It affects every supported ORDS version from 24.2.0 through 26.1.0, and it sits in the Backend-as-a-Service component, which many organizations expose directly to the internet.

Technical information

The vulnerable component

CVE-2026-46840 targets the Backend-as-a-Service (BaaS) component within Oracle REST Data Services. ORDS is the HTTPS Web Gateway for Oracle Database. It provides REST APIs for data and databases, Oracle Database Actions, Oracle APEX access, and the Oracle Database API for MongoDB. The BaaS component provides backend services for mobile and web applications. Developers use it to define REST APIs backed by SQL and PL/SQL and to REST-enable tables, views, and stored procedures.

BaaS endpoints are designed to serve external client applications, so they are typically among the most exposed parts of an ORDS deployment and are often accessible from the public internet.

CVSS 3.1 vector analysis

The full CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives the maximum base score of 10.0. The table below breaks down each metric.

Scope change and impact beyond ORDS

The Changed scope (S:C) designation is the most architecturally significant part of this vulnerability. It means that exploiting ORDS can compromise other products or systems connected to it. ORDS sits as a gateway between external clients and Oracle Databases, so the downstream impact likely extends to the database tier, any applications relying on ORDS for data access, and potentially adjacent systems in the same network segment.

This follows directly from how ORDS works. By design, it has privileged connectivity to Oracle Database instances, and a full takeover of ORDS could give an attacker the same level of database access that ORDS itself holds.

Attack surface and exploitation characteristics

The vulnerability is exploitable via HTTPS, the primary protocol ORDS uses for all its services. Oracle describes it as "easily exploitable," which in Oracle's risk matrix taxonomy means a successful attack requires minimal effort and no specialized conditions. An attacker needs only network connectivity to the ORDS endpoint. No credentials, prior access, or user interaction are required.

The BaaS component processes requests from client applications through exposed API endpoints. The attack surface likely involves these unauthenticated request-handling paths, though the specific vulnerability class (SQL injection, deserialization, authentication bypass, or otherwise) has not been publicly disclosed. No CWE ID has been assigned, and no proof-of-concept code has been published.

What remains unknown

These technical details have not been disclosed:

• The precise vulnerability type and root cause
• CWE classification
• Proof of concept or exploit code
• The exact remediated ORDS version number (though the May 2026 CSPU includes the fix)

Xchglabs, an external security research entity, reported the vulnerability to Oracle, which indicates that third parties are actively auditing ORDS.

Affected systems and versions

All supported versions of Oracle REST Data Services are affected. The vulnerable version range is 24.2.0 through 26.1.0, which includes:

• 24.2.0, 24.2.1
• 24.3.0, 24.3.1
• 24.4.0
• 25.1.0, 25.2.0, 25.3.0, 25.4.0
• 26.1.0

Any ORDS deployment that runs a version in this range and exposes the Backend-as-a-Service component is vulnerable. Deployments with ORDS endpoints accessible from the internet are at the highest risk, because the attack vector is network-based and needs no authentication.

Vendor security history

Vulnerability disclosures for Oracle REST Data Services have climbed throughout 2026:

The May 2026 CSPU's ORDS patch count is a five-fold increase over the prior quarter, which suggests that security researchers are scrutinizing the product more closely. Seven of the 11 patches address vulnerabilities that are remotely exploitable without authentication.

The pattern is worth watching because of what happened in March 2025, when an Oracle Cloud breach exploited CVE-2021-35587, an older vulnerability in Oracle Access Manager. Oracle confirmed the breach occurred via outdated, unpatched servers rather than cloud infrastructure vulnerabilities. The incident showed the real-world consequences of delayed patching in Oracle environments. It also showed the potential for scope escalation attacks, where an attacker uses a vulnerability in one Oracle product to compromise adjacent systems.

Oracle also introduced the CSPU designation for this release in place of the standard quarterly CPU cadence. That signals Oracle considered these findings severe enough to warrant an out-of-cycle or specially designated release.

References

• NVD: CVE-2026-46840
• Oracle Security Critical Patch Update Advisory, May 2026
• Text Form of Oracle CSPU May 2026 Risk Matrices
• Oracle Critical Patch Updates Portal
• Oracle REST Data Services Product Page
• Introduction to Oracle REST Data Services (Documentation)
• ORDS Release Notes 26.1.0
• Oracle REST Data Services Security Vulnerabilities in 2026 (Stack.Watch)
• Oracle Critical Patch Update Advisory, April 2026
• Oracle Critical Patch Update Advisory, January 2026
• Oracle Critical Patch Update Advisory, October 2025
• Oracle Cloud Breach Exploiting CVE-2021-35587 (Orca Security)
• Oracle Confirms Data Breach via Outdated Servers (Techzine)
• New York State ITS: Oracle Quarterly Critical Patches, April 2026
• CVE-2026-3910: Chrome V8 Zero-Day Analysis (SOC Prime)