Oracle Data Integrator Has Critical Unauthenticated RMI Flaw
A critical vulnerability in Oracle Data Integrator allows remote attackers to take over systems without authentication via RMI.
Key points
- CVE-2026-83396 affects Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0.
- The flaw allows unauthenticated network access via RMI to compromise the system.
- The National Vulnerability Database rates the severity as critical with a CVSS score of 9.8.
Oracle Data Integrator contains a critical vulnerability that allows unauthenticated attackers to take over the system remotely. The National Vulnerability Database lists the flaw as CVE-2026-83396 with a CVSS base score of 9.8. Attackers can exploit this issue via RMI over the network without needing any credentials.
The vulnerability resides in the Console and Repository Explorer components of Oracle Fusion Middleware. According to the NVD record, the weakness is easily exploitable and impacts confidentiality, integrity, and availability. Successful exploitation results in full takeover of the Oracle Data Integrator instance.
Context and Background
The flaw is classified as critical due to its low attack complexity and high impact scores. The CVSS vector indicates that no user interaction is required for exploitation. Network access is the only prerequisite for an attacker to target the vulnerable service.
This vulnerability affects specific supported versions of the software. The NVD record identifies Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 as affected. Other versions are not listed in the current advisory.
Who Is Affected
Organizations using Oracle Data Integrator for data integration tasks are at risk. Specifically, those running versions 12.2.1.4.0 or 14.1.2.0.0 are exposed. The vulnerability allows remote takeover of the system via the RMI protocol.
The attack vector is network-based, meaning external attackers can target exposed instances. The lack of authentication requirements makes this a high-priority issue for security teams. Internal network access also poses a significant threat.
What should you do?
Security professionals should immediately verify their Oracle Data Integrator versions. If running 12.2.1.4.0 or 14.1.2.0.0, systems are vulnerable. Isolate affected instances from untrusted networks if possible. Monitor for unusual RMI traffic or unauthorized access attempts.
What to do and how to stay safe: Oracle
- Inventory all Oracle Data Integrator instances to confirm version numbers.
- Restrict network access to RMI ports for systems running vulnerable versions.
- Monitor logs for unauthorized RMI connections or unusual activity.
- Prepare to apply patches once the vendor releases an update.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Oracle Data Integrator are affected?
Versions 12.2.1.4.0 and 14.1.2.0.0 are affected by CVE-2026-83396.
What is the CVSS score for this vulnerability?
The CVSS 3.1 Base Score is 9.8, rated as critical.
Can attackers exploit this without authentication?
Yes, the vulnerability allows unauthenticated remote exploitation via RMI.
