SB2026111010 - Multiple vulnerabilities in Oracle REST Data Services

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111010

SB2026111010 - Multiple vulnerabilities in Oracle REST Data Services

Published: November 10, 2026

Security Bulletin ID SB2026111010
CSH Severity
High
Patch available
YES
Number of vulnerabilities 35
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 66% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 35 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-101374)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Backend-as-a-Service component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.


2) Improper input validation (CVE-ID: CVE-2026-101364)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Database Actions component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


3) Improper input validation (CVE-ID: CVE-2026-101493)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


4) Improper input validation (CVE-ID: CVE-2026-101383)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


5) Improper input validation (CVE-ID: CVE-2026-101360)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


6) Improper input validation (CVE-ID: CVE-2026-101368)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Backend-as-a-Service component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


7) Improper input validation (CVE-ID: CVE-2026-101381)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


8) Improper input validation (CVE-ID: CVE-2026-101380)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


9) Improper input validation (CVE-ID: CVE-2026-101367)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


10) Improper input validation (CVE-ID: CVE-2026-101379)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


11) Improper input validation (CVE-ID: CVE-2026-101369)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Backend-as-a-Service component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


12) Improper input validation (CVE-ID: CVE-2026-101375)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Database Actions component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


13) Improper input validation (CVE-ID: CVE-2026-91609)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Graph QL component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


14) Improper input validation (CVE-ID: CVE-2026-101362)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


15) Improper input validation (CVE-ID: CVE-2026-101494)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


16) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-9753)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper validation of specified type of input in the $_internalApplyOplogUpdate aggregation pipeline stage when processing a document diff containing a malformed binary diff. A remote user can execute the stage with a crafted document diff to disclose sensitive information and cause a denial of service.

The stage can be executed by a user with access to the aggregate command.


17) Code Injection (CVE-ID: CVE-2026-33941)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary JavaScript code.

The vulnerability exists due to improper neutralization of user-controlled input in the Handlebars CLI precompiler when generating JavaScript output from template file names and CLI options. A local user can supply specially crafted template names or option values to execute arbitrary JavaScript code.

The issue affects bin/handlebars and lib/precompiler.js through multiple injection points involving template names, namespace values, CommonJS paths, and AMD paths, and the injected code executes when the generated bundle is loaded in Node.js or a browser. User interaction is required to load the generated bundle.


18) Improper input validation (CVE-ID: CVE-2026-91610)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the General component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


19) Improper input validation (CVE-ID: CVE-2026-101366)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


20) Improper input validation (CVE-ID: CVE-2026-101377)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Database Actions component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to perform service disruption.


21) Improper input validation (CVE-ID: CVE-2026-101371)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to read and manipulate data.


22) Improper input validation (CVE-ID: CVE-2026-101370)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


23) Improper input validation (CVE-ID: CVE-2026-101372)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


24) Improper input validation (CVE-ID: CVE-2026-101386)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


25) Improper input validation (CVE-ID: CVE-2026-101382)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


26) Improper input validation (CVE-ID: CVE-2026-101361)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to read and manipulate data.


27) Improper input validation (CVE-ID: CVE-2026-101378)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the ADP component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to manipulate data.


28) Improper input validation (CVE-ID: CVE-2026-101373)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to manipulate data.


29) Improper input validation (CVE-ID: CVE-2026-101376)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Database Actions component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to read and manipulate data.


30) Improper input validation (CVE-ID: CVE-2026-101365)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Database Actions component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to read and manipulate data.


31) Improper input validation (CVE-ID: CVE-2026-101385)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote privileged user can exploit this vulnerability to manipulate data.


32) Improper input validation (CVE-ID: CVE-2026-101384)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.


33) Improper input validation (CVE-ID: CVE-2026-101363)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Graph QL component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


34) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-54515)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify otherwise ignored object attributes.

The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.

Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.


35) Improper input validation (CVE-ID: CVE-2026-101359)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Core component in Oracle REST Data Services. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.


Remediation

Install update from vendor's website.

References