{"id":"CVE-2026-83397","published":"2026-10-20T22:19:56.200","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to fully compromise Oracle Data Integrator instances through HTTP requests, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw enables attackers to take complete control of the system with high impact on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to compromise the system through simple HTTP network access.","blast_radius":"If exploited, this vulnerability could lead to complete takeover of Oracle Data Integrator systems, potentially affecting data integration processes and exposing sensitive enterprise data across multiple applications.","remediation":"Upgrade to Oracle Data Integrator 14.1.3.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","unauthenticated","data-integration"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:26.395Z"}}