CVE-2026-46840
CRITICALOracle REST Data Services 24.2.0-26.1.0 - Unauthenticated Remote Code Execution via HTTPS
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-46840. PoCs published by fangbarristerbar.
AI-analyzed exploit summary The repository claims to provide an exploit for CVE-2026-46840 (Oracle ORDS RCE) but contains no actual exploit code. Instead, it directs users to a payment link for access to the exploit, which is a common tactic for scams or malware distribution.
Description
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Exploits (1)
The repository claims to provide an exploit for CVE-2026-46840 (Oracle ORDS RCE) but contains no actual exploit code. Instead, it directs users to a payment link for access to the exploit, which is a common tactic for scams or malware distribution.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H