CVE-2026-46840: Critical Oracle ORDS Takeover

Are You Affected?

CVE-2026-46840 is an Oracle REST Data Services vulnerability affecting the Backend-as-a-Service component in versions 24.2.0 through 26.1.0. The vulnerability is remotely exploitable over HTTPS and may allow an unauthenticated attacker to take over ORDS. Because the CVSS scope is changed, a successful compromise may affect resources beyond the immediate ORDS security boundary.

Treat an ORDS deployment as potentially affected if its installed version falls within 24.2.0 through 26.1.0. The available NVD information does not provide more granular build-level exclusions. Compare the exact installed build with Oracle’s May 2026 Critical Patch Update advisory rather than assuming that a particular patch bundle or platform packaging is unaffected.

The risk is highest for ORDS instances reachable from the public internet or broad internal network segments. Internet exposure is not required for practical risk. An attacker who can reach an affected HTTPS listener through a VPN, cloud security group, reverse proxy, bastion path, or compromised internal host may be able to attempt exploitation without credentials.

Analyst’s Take: Start with version and exposure inventory, then restrict access while the Oracle advisory is checked. The absence of a verified fixed version means administrators should not mark an instance remediated based only on a packaging assumption or network control.

The Fix, If You’re in a Hurry

Oracle’s May 2026 Critical Patch Update advisory is the authoritative source for the applicable ORDS remediation. The supplied research does not verify a specific first-fixed ORDS version, so no fixed version number should be inferred. Identify the installed ORDS release, locate CVE-2026-46840 in Oracle’s advisory, and deploy the corresponding Oracle-provided update.

Until the vendor-specific fixed version is confirmed and installed, reduce exposure immediately. Restrict inbound access to ORDS at the load balancer, firewall, reverse proxy, cloud security group, or container ingress layer. Permit only required administrative and application networks, and remove direct internet access where it is not essential. These controls reduce attack surface but do not remediate the vulnerability.

Technical Notes

First identify the ORDS installation and runtime version using the command supported by the deployment method. For installations where the ORDS executable is available, administrators can start with:

ords --version

If the command is not on the path, locate the deployed ORDS binary or package and record the version from the installation metadata. Do not rely solely on a web banner, because reverse proxies and application servers can obscure the actual ORDS release.

A temporary network control should be implemented outside ORDS. For example, an allowlist policy at a reverse proxy or firewall should restrict the ORDS listener to known application and administrative networks:

Allow TCP/HTTPS to ORDS only from:
  - approved application subnets
  - approved administrator VPN ranges

Deny all other inbound sources.

This is a compensating control, not a substitute for the Oracle update. After updating, restart the ORDS service using the service manager used by the deployment, then verify that the running process and package inventory report the intended fixed release.

How This Vulnerability Works

The vulnerability is in Oracle REST Data Services’ Backend-as-a-Service component. NVD describes it as an easily exploitable flaw that permits an unauthenticated attacker with network access via HTTPS to compromise ORDS. A successful attack can result in takeover of Oracle REST Data Services.

The available vulnerability record does not disclose the specific root cause. It does not identify a vulnerable endpoint, request format, parser, authorization check, injection condition, memory-safety defect, or other implementation detail. Defenders should not assume that disabling one guessed endpoint or filtering one guessed payload reliably mitigates the issue.

The CVSS scope-changed designation is important operationally. It indicates that compromise can affect resources beyond the security authority of the vulnerable ORDS component. ORDS commonly provides access to database-backed APIs and services, so a compromised deployment may create follow-on risk for connected applications, data, credentials, and administrative workflows. The exact downstream impact depends on the ORDS configuration and database privileges.

Technical Notes

The published information supports the following attack model:

Remote client
    |
    | HTTPS, no authentication, no user interaction
    v
Oracle REST Data Services
    |
    | Potential compromise and scope change
    v
Connected services, applications, or data resources

Because the vulnerable request path and exploit syntax are not available in the supplied sources, organizations should avoid creating speculative signatures based on unverified URLs or parameters. Detection should instead combine exposure inventory, HTTP telemetry, process activity, authentication events, and changes to connected services.

Severity, Explained

CVE-2026-46840 has a CVSS v3.1 base score of 10.0, the highest possible rating. Its vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The network attack vector means the attacker does not need local access. Low attack complexity means no unusual environmental condition or complex prerequisite is represented in the score. Privileges required are none, so an attacker does not need an ORDS account before attempting exploitation. User interaction is also none, removing the need to trick an administrator or application user into performing an action.

The impact metrics are all high. Confidentiality impact can include unauthorized access to sensitive data, integrity impact can include unauthorized modification or control, and availability impact can include service disruption or takeover. The changed scope increases concern because the consequences may extend beyond ORDS itself. The score does not prove that every deployment will suffer identical downstream effects; database permissions, network segmentation, and application architecture still influence impact.

A CVSS 10.0 score should drive urgent remediation, but it should not be interpreted as evidence that exploitation is confirmed. Severity describes the potential impact and exploit conditions, while exploitation status requires separate evidence.

Is It Being Exploited?

CVE-2026-46840 was not listed in the CISA Known Exploited Vulnerabilities catalog in the supplied lookup. The result was:

CVE: CVE-2026-46840
on_kev: false

Therefore, there is no CISA date-added date, due date, required-action entry, or ransomware-campaign flag to report. The absence of a KEV listing does not establish that exploitation has never occurred. It only means the CVE was not included in that catalog at the time of checking.

No public proof-of-concept repository or exploit reference was identified in the supplied NVD references. Based on the available information, public PoC status is unknown beyond the absence of an identified public PoC, and confirmed exploitation in the wild is not reported. Security teams should state this carefully in risk registers: there is no supplied confirmation of active exploitation, but the vulnerability remains highly attractive because it is remote, unauthenticated, and potentially service-taking.

Organizations should continue monitoring Oracle security advisories, CISA updates, vendor intelligence, incident-response feeds, and internal telemetry. Threat status can change after disclosure, and KEV inclusion may lag independent exploitation evidence.