Oracle Data Integrator CVE-2026-35262

Attacker must have network HTTP reachability to the Oracle Data Integrator Market Place component on an affected ODI deployment (12.2.1.4.0 or 14.1.2.0.0) and must hold valid credentials for at least a low-privileged ODI account (CVSS PR:L); no user interaction, no admin role, and no non-default configuration are required, and the Market Place component is part of standard ODI Fusion Middleware installations. Exploitation is limited where the ODI HTTP interface is firewalled to administrative networks, where low-privileged accounts are tightly governed, or where the affected versions are not deployed; conversely, environments that expose ODI to broad internal user populations or to the internet substantially widen the attacker pool.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, score 8.3) describes a network-reachable, low-complexity flaw requiring only a low-privileged account and no user interaction, which is a realistic profile for an internally exposed ETL platform where many integration developers and operators hold low-tier accounts. Oracle's own description calls it 'easily exploitable,' reinforcing the low-complexity rating. However, EPSS data, SSVC decisions, and KEV status are not provided in the input, and there is no public POC referenced, so probability of mass exploitation cannot be quantified - treat this as a high-impact, plausible-target issue rather than confirmed in-the-wild abuse. Because ODI typically holds credentials and data flows for many downstream systems, the C:H/I:H rating can cascade well beyond ODI itself, which justifies prioritizing the patch ahead of similarly scored Fusion Middleware advisories.

An attacker who has obtained any low-privileged ODI account - for example a junior integration developer credential phished from a contractor - sends crafted HTTP requests to the Market Place component over the network and abuses it to read or alter data the account should not be able to touch, exfiltrating sensitive integration metadata and tampering with ETL definitions to redirect downstream data flows. No user interaction is required, complexity is low, and a partial denial of service of ODI itself can also be induced, disrupting scheduled batch jobs; no public exploit identified at time of analysis, but Oracle characterizes the flaw as easily exploitable.