CVE-2026-46840Patch(oracle / rest_data_services)

HIGHCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch oracle rest_data_services systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

oracle CVEs Back to dashboard

7.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.oracle.com/security-alerts/cspumay2026.html

Weakness type (CWE)

CWE-284CWE-287CWE-306

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rest_data_services

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
11 mentions across 7 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 7 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 5d ago at 3 mentions (2026-05-29); latest day: 1
11 total mentions across 7 days

Affected systems

Vendors

oracle

Products

rest_data_services

Deep dive

Activity timeline11 mentions / 7d

Signal classification5 categories

Patch

436.4%

Disclosure

327.3%

General

218.2%

Active Exploitation

19.1%

Exploit

19.1%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	2	Disclosure1Patch1
2026-05-29	3	Active Exploitation1Patch2
2026-06-01	2	Disclosure1Patch1
2026-06-02	1	Exploit1
2026-06-05	1	Disclosure1
2026-06-10	1	General1
2026-06-13	1	General1

Full discourse11 posts

GovCERT.CZ@GOVCERT_CZ133d
Disclosure
🚨 Upozorňujeme na kritickou zranitelnost v Oracle REST Data Services, CVE-2026-46840. Zranitelnost v komponentě Oracle REST Data Services Backend-as-a-Service umožňuje vzdáleným neautentizovaným útočníkům plně kompromitovat zasažené systémy prostřednictvím HTTPS bez nutnosti přihlášení či interakce uživatele. Zneužití spočívá v zasílání speciálně upravených požadavků vedoucích k převzetí kontroly nad cílovým prostředím. Oracle současně v rámci May 2026 Critical Security Patch Update zveřejnil a opravil další kritické zranitelnosti, např. CVE-2026-46775 a CVE-2026-46839 (CVSS 9.9) v REST Data Services Core umožňující kompromitaci prostředí nízce privilegovaným útočníkem, CVE-2026-46833 (CVSS 9.0) v Oracle Database Server Net Services umožňující vzdálené narušení důvěrnosti, integrity a dostupnosti, a CVE-2026-46817 / CVE-2026-34311 (CVSS 9.8) v Oracle Payments a Oracle Hospitality OPERA 5 Property Services umožňující vzdálené neautentizované kompromitace. Další zranitelnosti s rozsahem CVSS 4.5–10.0 zasahují např. Oracle Communications Unified Assurance, E-Business Suite, finanční a middleware komponenty a některé jsou rovněž vzdáleně zneužitelné bez autentizace, což významně zvyšuje riziko útoků napříč infrastrukturou. 📌 Doporučujeme aktualizovat na nejnovější verzi.
Post summary
An Oracle REST Data Services vulnerability (CVE‑2026‑46840) lets unauthenticated attackers fully compromise systems through crafted HTTPS requests; Oracle recommends applying the May 2026 patch update.
02050510
4.2K followersView on X
SecAlerts@SecAlertsCo137d
Disclosure
CVSS 10.0 critical: CVE-2026-46840 hits Oracle REST Data Services (v24.2.0-26.1.0). No auth, no interaction, full C/I/A compromise. If you're running ORDS, treat this as urgent. #Oracle #PatchNow https://secalerts.co/vulnerability/CVE-2026-46840 https://t.co/cSCTUBOUq4
Post summary
The tweet announces a new critical vulnerability (CVE‑2026‑46840) affecting Oracle REST Data Services with no auth or user interaction required, urging users to patch promptly.
011101.6K
826 followersView on X
Kaitan ID Security@KaitanSecurity129d
Disclosure
⚡ Oracle REST Data Services: Easily Exploitable Critical CVE-2026-46840 (CVSS 10.0) affects Oracle REST Data Services versions 24.2.0 through 26.1.0, targeting the Backend-as-a-Service component. Described as easily exploitable and…
Post summary
The post announces CVE‑2026‑46840 as a critical vulnerability in Oracle REST Data Services, providing basic technical details and a high CVSS score but lacking exploit, patch, or exploitation evidence.
1000030
83 followersView on X
CCB Alert@CCBalert136d
Patch
Warning: Critical #vulnerabilities in #Oracle REST Data Services & E-Business Suite allow system takeover. #CVE-2026-46840 CVSS(3.1): 10.0 | #CVE-2026-46817 CVSS(3.1): 9.8. Part of a larger Oracle patch update. Read our advisory at https://ccb.belgium.be/advisories/warning-multiple-vulnerabilities-oracle-products-patch-immediately-0 and #Patch #Patch #Patch
Post summary
The post announces critical Oracle vulnerabilities with high CVSS scores and directs readers to a patch advisory, but does not provide PoC, exploit code, or evidence of active exploitation.
01000226
7.2K followersView on X
Orizon@OrizonCyber137d
Patch
🚨 CVE-2026-46840 — CVSS 10/10 ██████████ Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/lWD9jY4tgZ
Post summary
Oracle REST Data Services is affected by CVE-2026-46840, a 10/10 critical vulnerability; a patch is available.
10000132
42 followersView on X
IntegSec@integ_sec121d
General
CVE-2026-46840: Oracle REST Data Services Backend-as-a-Service Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04ljHRM0
Post summary
The post references CVE-2026-46840 without providing technical details, PoC, exploitation evidence, or mitigation information.
0000032
31 followersView on X
CERT-PY@CERTpy124d
General
⚠️ Vulnerabilidades en productos Oracle ❗ CVE-2026-46840 ❗ CVE-2026-46839 ❗ CVE-2026-46824 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-oracle-3/ https://t.co/tIix6oKklC
Post summary
The tweet lists three Oracle CVEs and directs readers to a link for more information, but does not include any technical details, exploits, or mitigation steps.
0000070
6.7K followersView on X
Kaitan ID Security@KaitanSecurity132d
Exploit
⚠️ CVE of the week — CVE-2026-46840 (CVSS 10.0) · NVD/NIST 💣 Exploit available Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are… https://sec.kaitan.id/cves/CVE-2026-46840?utm_source=x&utm_campaign=tuesday_highlight https://t.co/aaVuv96yha
Post summary
The tweet announces CVE‑2026‑46840 with a CVSS 10.0 score, noting that an exploit is available, though it does not mention active exploitation or patch information.
0000038
85 followersView on X
セキュリティ対策Lab@securityLab_jp133d
Patch
Oracleが2026年5月の定例パッチを公開-致命的な脆弱性 CVE-2026-46840など35件を修正 https://rocket-boys.co.jp/security-measures-lab/oracle-critical-patch-update-may-2026-cve-2026-46840/ #セキュリティ対策Lab #security #securitynews
Post summary
Oracle announced the release of its May 2026 routine patch, which addresses 35 vulnerabilities including CVE‑2026‑46840; no exploit or active exploitation details are mentioned.
00000109
409 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨 Critical - Oracle May 2026 Security Patch Update Oracle released patches for multiple critical vulnerabilities affecting Oracle Database Server, REST Data Services (ORDS), E-Business Suite, and Hospitality products. Included critical CVEs: • CVE-2026-34311 • CVE-2026-46775 • CVE-2026-46817 • CVE-2026-46819 • CVE-2026-46822 • CVE-2026-46824 • CVE-2026-46833 • CVE-2026-46839 • CVE-2026-46840 Several issues are remotely exploitable and may allow unauthenticated attackers to achieve code execution, compromise vulnerable services, or cause denial of service. 👉 Affected: Multiple Oracle enterprise products including ORDS, Oracle Database, E-Business Suite, and Hospitality OPERA 👉 Action: Apply Oracle’s May 2026 Critical Patch Update immediately
Post summary
Oracle announced its May 2026 Critical Patch Update for multiple CVEs, urging users to apply the patches immediately to mitigate remotely exploitable code execution vulnerabilities.
0000083
196 followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
A lot of offensive activities were identified targeting Oracle REST Data Services (CVE-2026-46840) https://vuldb.com/vuln/366926/cti
Post summary
The post indicates that CVE-2026-46840 is currently being exploited in the wild against Oracle REST Data Services, as evidenced by the mention of numerous offensive activities.
0000075
2.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	oracle	rest_data_services	-	-	-

Explore more

Back to dashboard oracle CVEs rest_data_services vulnerabilities

What researchers are saying

CVE-2026-46840

GovCERT.CZ[verified]@GOVCERT_CZDisclosure

An Oracle REST Data Services vulnerability (CVE‑2026‑46840) lets unauthenticated attackers fully compromise systems through crafted HTTPS requests; Oracle recommends applying the May 2026 patch update.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post announces CVE‑2026‑46840 as a critical vulnerability in Oracle REST Data Services, providing basic technical details and a high CVSS score but lacking exploit, patch, or exploitation evidence.

Orizon[verified]@OrizonCyberPatch

Oracle REST Data Services is affected by CVE-2026-46840, a 10/10 critical vulnerability; a patch is available.

IntegSec[verified]@integ_secGeneral

The post references CVE-2026-46840 without providing technical details, PoC, exploitation evidence, or mitigation information.

Kaitan ID Security[verified]@KaitanSecurityExploit

The tweet announces CVE‑2026‑46840 with a CVSS 10.0 score, noting that an exploit is available, though it does not mention active exploitation or patch information.

セキュリティ対策Lab[verified]@securityLab_jpPatch

Oracle announced the release of its May 2026 routine patch, which addresses 35 vulnerabilities including CVE‑2026‑46840; no exploit or active exploitation details are mentioned.

Upwind Security MDR[verified]@UpwindMDRPatch

Oracle announced its May 2026 Critical Patch Update for multiple CVEs, urging users to apply the patches immediately to mitigate remotely exploitable code execution vulnerabilities.

SecAlerts@SecAlertsCoDisclosure

The tweet announces a new critical vulnerability (CVE‑2026‑46840) affecting Oracle REST Data Services with no auth or user interaction required, urging users to patch promptly.