Oracle Data Integrator Has Critical Unauthenticated Remote Code Execution Flaw
A CVSS 9.8 vulnerability in Oracle Data Integrator allows network-based attackers to take over the system without credentials.
Key points
- CVE-2026-83397 affects Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0.
- The flaw is rated Critical with a CVSS score of 9.8 by the National Vulnerability Database.
- Attackers need only network access via HTTP to exploit the issue without authentication.
The National Vulnerability Database has published details for CVE-2026-83397, a critical security flaw in Oracle Data Integrator. This vulnerability allows unauthenticated attackers to take control of the software through standard network connections. The issue resides within the Console and Repository Explorer components.
According to the NVD record, the flaw carries a CVSS 3.1 Base Score of 9.8. This rating reflects high impacts on confidentiality, integrity, and availability. The vulnerability is classified as easily exploitable. Attackers do not need user credentials or interaction to trigger the exploit.
Technical Context
The vulnerability exists in the Oracle Data Integrator product, which is part of the broader Oracle Fusion Middleware suite. Specifically, the flaw is located in the Console and Repository Explorer components. The NVD describes the weakness as allowing an unauthenticated attacker with network access via HTTP to compromise the system.
The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates the attack vector is network-based and requires low complexity. No privileges or user interaction are needed. The scope remains unchanged, but confidentiality, integrity, and availability are all highly impacted.
Affected Versions
Only two specific versions of Oracle Data Integrator are listed as affected by this vulnerability. These are version 12.2.1.4.0 and version 14.1.2.0.0. Organizations running these releases are exposed to the risk of remote takeover.
The NVD record does not list earlier or later versions as vulnerable. It is critical for administrators to verify their exact version numbers against this list. If your environment runs either of these two versions, you are potentially at risk from unauthenticated network attacks.
What should you do?
Administrators should immediately audit their Oracle Data Integrator installations to check for versions 12.2.1.4.0 and 14.1.2.0.0. Network segmentation can help restrict HTTP access to these components. Monitor logs for unusual activity from unauthenticated sources.
What to do and how to stay safe: Oracle
- Verify the exact version of Oracle Data Integrator running in your environment against the affected list.
- Restrict network access to the Console and Repository Explorer components to trusted IPs only.
- Monitor HTTP traffic logs for unauthenticated requests or unusual activity patterns.
- Prepare to isolate affected systems if no patch is available and exploitation is detected.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-83397?
The CVSS 3.1 Base Score is 9.8, which is rated as Critical.
Which Oracle Data Integrator versions are affected?
Versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this vulnerability.
Do attackers need credentials to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to compromise the system via HTTP.
