CVE-2026-83397

Analyzed Analyzed - Analysis Complete

Oracle Data Integrator Remote Code Execution Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-11-04

Assigner: Oracle

Description

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-04

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-83397

EUVD

EUVD-2026-106315

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	data_integrator	12.2.1.4.0
oracle	data_integrator	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker to remotely compromise the system via HTTP, potentially taking full control of the Oracle Data Integrator product.

Detection Guidance

This vulnerability can be detected by checking for unpatched versions of Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0. Verify installed versions against Oracle's security advisories and ensure the latest patches are applied.

Impact Analysis

If exploited, this vulnerability could lead to complete system takeover, allowing attackers to access, modify, or delete sensitive data, disrupt operations, or install malicious software. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise Oracle Data Integrator, potentially leading to unauthorized access, data breaches, or system takeover. Such breaches could violate GDPR by exposing personal data or HIPAA by compromising protected health information, depending on the data processed by the system.

Mitigation Strategies

Apply the latest Oracle Data Integrator patches immediately as they address this vulnerability. Restrict network access to the Oracle Data Integrator console via HTTP to trusted sources only. Disable unnecessary services and ensure firewalls are configured to block unauthorized access.

Hi! I’m here to help you understand CVE-2026-83397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...