Is CVE-2026-46839 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46839 being exploited in the wild.

How severe is CVE-2026-46839?

Critical severity, with a CVSS score of 9.9, published 28 May 2026.

Which products and versions are affected?

Oracle REST Data Services 24.2.0-26.1.0.

Is there a fix for CVE-2026-46839?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-46839 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-46839?

Check whether you run Oracle REST Data Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46839: Oracle REST Data Services takeover in Core component

CVE-2026-46839 · Severity: critical · CVSS 9.9 · Published 2026-05-28

Oracle REST Data Services, a tool that enables developers to use HTTP(S) and REST to work with Oracle Databases, contains a critical security vulnerability in its core component. A user with even low-level access to the network can exploit this flaw to take complete control of the service. Because this tool connects directly to database environments, a successful attack could lead to widespread data theft, service disruption, and potential unauthorized access to connected systems.

Technologies: Oracle REST Data Services. Vendors: Oracle.

Quick answers

Is CVE-2026-46839 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46839 being exploited in the wild.
How severe is CVE-2026-46839?: Critical severity, with a CVSS score of 9.9, published 28 May 2026.
Which products and versions are affected?: Oracle REST Data Services 24.2.0-26.1.0.
Is there a fix for CVE-2026-46839?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-46839 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46839?: Check whether you run Oracle REST Data Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical vulnerability exists in the Core component of Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0. The flaw is categorized as easily exploitable and allows a low-privileged attacker with network access via HTTPS to compromise the service. Notably, the vulnerability includes a 'scope change' (S:C), indicating that an exploit can impact components beyond the ORDS environment itself, potentially affecting the underlying database or integrated Oracle products. Successful exploitation results in a complete takeover of the ORDS instance, impacting confidentiality, integrity, and availability. Users are advised to consult the Oracle May 2026 security alert for patching information.

Affected products

Oracle REST Data Services 24.2.0-26.1.0

Timeline

2026-05-28: advisory: Initial disclosure by Oracle and NVD publication

References

https://www.oracle.com/security-alerts/cspumay2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.