EUVD-2026-46983
GHSA-7mch-hf92-496m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires prior low-privileged local logon on the ODI host (AV:L, PR:L), no user interaction and low complexity, yielding full product takeover with high C/I/A.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Technical ContextAI
Oracle Data Integrator is Oracle Fusion Middleware's ELT/data-integration platform; the affected component is ODI Studio, the thick-client/design-time IDE used by developers to build and run integration mappings. The vulnerability is exploited from the operating-system infrastructure where ODI executes rather than over the network, indicating a local attack surface such as insecure handling of local files, credentials, configuration, or IPC by the Studio process running under a more privileged context. Oracle does not map a CWE (CWE: N/A) and provides no root-cause class; the vendor tag 'Information Disclosure' combined with the C:H/I:H/A:H impact and 'takeover' language suggests an issue that escalates a low-privileged local account to control of the ODI product rather than a pure read-only disclosure.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers and post-install steps for your ODI 12.2.1.4.0 or 14.1.2.0.0 deployment (Patch available per vendor advisory - Oracle CPUs ship as version-specific bundle patches rather than a single tagged release number in this data). Because exploitation requires local logon to the ODI host, until patching is complete restrict interactive and shell access to the servers running ODI Studio to a minimal set of trusted administrators, remove or tighten unnecessary low-privileged local accounts, and monitor local logons and process activity on those hosts; these controls reduce exposure but do not remediate the underlying flaw and may disrupt legitimate multi-user development workflows. Do not expose the ODI infrastructure host to shared or untrusted users while unpatched.
More in Data Integrator
View allApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
SQL Injection exists in the CheckList 1.1.1 component for Joomla!. Rated critical severity (CVSS 9.8), this vulnerabilit
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attack
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service compone
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today