{"id":"CVE-2026-83396","published":"2026-10-20T22:19:56.087","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Oracle Data Integrator has an unauthenticated RMI vulnerability in its Console/Repository Explorer component that allows remote attackers to fully compromise the system with high impact on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing network-based attackers to gain full control of Oracle Data Integrator through RMI connections.","blast_radius":"Successful exploitation could lead to complete takeover of Oracle Data Integrator systems, potentially affecting data integration workflows and exposing sensitive enterprise data across the organization.","remediation":"Upgrade to Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0 to address this vulnerability, as these are the affected versions mentioned in the CVE description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","rmi","oracle","data-integration"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:21.126Z"}}