Oracle REST Data Services (CSPU May 2026)

critical Nessus Plugin ID 318834

Synopsis

The remote host is running a version of Oracle REST Data Services that is affected by multiple vulnerabilities.

Description

The version of Oracle REST Data Services (ORDS) installed on the remote host is 24.2.0 through 26.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the May 2026 Critical Security Patch Update (CSPU) advisory.

- Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.
(CVE-2026-46840)

- Vulnerability in Oracle REST Data Services (component: Core). Easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. (CVE-2026-46775, CVE-2026-46839)

- Vulnerability in Oracle REST Data Services (component: Core). Easily exploitable vulnerability allows a low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. (CVE-2026-35277)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the May 2026 Oracle Critical Security Patch Update advisory.

Plugin Details

Severity: Critical

ID: 318834

File Name: oracle_rest_data_services_cspu_may_2026.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 6/5/2026

Updated: 6/5/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.1

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-46840

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:oracle:rest_data_services

Required KB Items: installed_sw/Oracle REST Data Services

Patch Publication Date: 5/28/2026

Vulnerability Publication Date: 5/28/2026

Reference Information

CVE: CVE-2026-35266, CVE-2026-35277, CVE-2026-46775, CVE-2026-46829, CVE-2026-46830, CVE-2026-46839, CVE-2026-46840, CVE-2026-46841, CVE-2026-46842, CVE-2026-46843

IAVA: 2026-A-0527

Detections

Analytics