EUVD-2026-47232
GHSA-qj94-r63r-g3g4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Data Integrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Data Integrator 14.1.2.0.0 (Fusion Middleware) contains a critical remote code execution vulnerability (CVSS 9.8) that allows unauthenticated network attackers to fully compromise the system via the REST Service component; no public exploit identified at time of analysis. Organizations using this middleware for data integration face immediate risk of data theft, manipulation, or operational disruption. No vendor patch is currently available, making urgent compensating controls essential.
Within 24 hours, inventory all systems running Oracle Data Integrator 14.1.2.0.0 and immediately restrict network access to the REST Service component-allow HTTPS traffic only from trusted administrative networks via VPN or network segmentation. Within 7 days, deploy Web Application Firewall rules to monitor and block anomalous requests to REST Service endpoints, enable full audit logging of all REST Service activity, subscribe to Oracle security advisories for patch notifications, and conduct a scope assessment of data processed by affected systems. Within 30 days, apply the vendor-released patch to all affected instances as soon as Oracle releases a fix, perform security validation of patched systems, and conduct a full forensic audit of REST Service access logs to detect any prior unauthorized activity.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict REST Service network access to trusted administrative networks only via VPN; deploy Web Application Firewall rules to detect and block exploitation attempts; enable comprehensive audit logging and real-time monitoring of REST Service activity; apply vendor-approved security configurations to the REST Service component; and establish continuous monitoring for Oracle security patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Data Integrator
View allApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
SQL Injection exists in the CheckList 1.1.1 component for Joomla!. Rated critical severity (CVSS 9.8), this vulnerabilit
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attack
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the in
Exploit-DB