Oracle Data Integrator CVE-2026-47056

The attacker needs network access to the Oracle Data Integrator REST Service component over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required, so this reflects unauthenticated remote exploitation of standard ODI deployments where the REST Service is reachable. The only meaningful limiting factor is reachability of the REST endpoint: instances whose REST Service is not exposed to the attacker's network segment (e.g., isolated behind firewalls or not internet-facing) reduce realistic exposure. Affected versions are specifically 12.2.1.4.0 and 14.1.2.0.0.

This is a genuine top-tier priority, not a high-score-low-risk case. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0: network attack vector, low complexity, no privileges, no user interaction, scope change, and full CIA impact. Oracle itself describes it as 'easily exploitable' by an unauthenticated attacker over HTTP, and the scope change means blast radius extends beyond ODI. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation yet. The signals are consistent rather than conflicting; the only gap is the absence of exploitation-probability data (EPSS) and CWE root-cause classification. Given the maximum severity and pre-auth network reach, defenders should treat this as high urgency independent of the missing EPSS signal - such flaws in internet- or intranet-reachable middleware are frequently reverse-engineered from the patch shortly after CPU release.

An attacker with network reachability to the ODI REST Service sends a specially crafted, unauthenticated HTTP request that abuses the endpoint to gain full control of the Oracle Data Integrator instance. From that foothold, because of the scope change, the attacker leverages the compromised middleware to reach and impact adjacent Fusion Middleware components and the data flowing through ODI. No public exploit code has been identified at time of analysis, but the low attack complexity means a working exploit could be developed quickly once the patch is analyzed.