EUVD-2026-79584
GHSA-6h39-f2j4-q3f9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed ODI Console/Repository Explorer
-
DeliverySend crafted HTTP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain administrative control
-
ImpactFull takeover of Data Integrator and repository
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated (PR:N) exploitation over HTTP against the Console / Repository Explorer component of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0, with no user interaction required (UI:N) and low attack complexity (AC:L). The primary limiting factor is network reachability of the ODI Console/Repository Explorer HTTP interface: instances behind segmentation, VPN, or not internet-exposed materially reduce exposure. Only the two named Fusion Middleware versions are affected, so exploitation is bounded to those deployments. |
| Impact | This is a genuinely high-priority vulnerability. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a remotely reachable, low-complexity, pre-authentication flaw (PR:N) requiring no user interaction that yields full compromise (complete confidentiality, integrity, and availability impact) of Oracle Data Integrator. CWE-287 (improper authentication) is consistent with the 'Authentication Bypass' tag and with Oracle's description of an unauthenticated takeover. The SSVC decision framework corroborates the severity: Automatable=yes and Technical Impact=total align with an easily scripted, high-consequence attack. However, the signals are not uniform - SSVC Exploitation is 'none', there is no CISA KEV listing, no public POC referenced, and no EPSS score is provided in the input, so there is no evidence of active exploitation at time of analysis. In short, the theoretical severity and automatability are near-maximal, but real-world exploitation is currently unproven. Given Oracle Fusion Middleware components are recurring targets after CPU disclosure, this should be treated as a patch-now item despite the current absence of exploitation evidence. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the Oracle Data Integrator Console / Repository Explorer sends a crafted HTTP request that bypasses authentication and gains control of the ODI instance, leading to full takeover of the integration platform and its repository data. No user interaction or credentials are required (PR:N/UI:N), making the attack easily automatable per SSVC. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers who can reach the Oracle Data Integrator Console / Repository Explorer over HTTP can bypass authentication entirely (CWE-287) and take full control of the affected deployment, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware's ODI product. The flaw is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special preconditions beyond network reachability of the console interface - the primary exposure limiter is whether the ODI Console is internet-facing versus segmented behind VPN or internal-only access. As of analysis, there is no CISA KEV entry and no public exploit identified at time of analysis, though CISA's SSVC assessment rates the issue as automatable with total technical impact, so patching should be treated as urgent rather than deferred.
RemediationAI
Apply the Oracle fix released through the vendor security alert referenced at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle patch availability is indicated by that advisory; a specific patched version or patch number is not provided in the source data, so confirm the exact interim/CPU patch ID against the advisory before upgrading). Until the patch is applied, the highest-value compensating control is network restriction of the ODI Console / Repository Explorer HTTP interface: terminate or filter access at a reverse proxy/WAF, allow only approved administrative source addresses, and place the console behind VPN or internal segmentation rather than exposing it to the internet - the trade-off is that legitimate remote administration must go through those controlled paths, and any operators who relied on direct access will be blocked. If the web Console is not operationally required, disable or unbind the Console/Repository Explorer service entirely, accepting the loss of the browser-based repository administration UI in exchange for eliminating the exposed attack surface. Because the SSVC assessment flags this as automatable with total technical impact, prioritize these actions over standard patch-cycle scheduling, and note that no public exploit code has been identified at time of analysis, so these measures are preventive rather than emergency incident response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Data Integrator is a data integration/ETL platform within Oracle Fusion Middleware, and the affected component is the web-based Console and its Repository Explorer, which is the administrative UI used to browse, manage, and execute integration objects stored in the ODI repository. The root cause class is CWE-287 (Improper Authentication): the application fails to correctly verify or enforce the identity of the requester, so a request handled over HTTP can be processed as though it came from an authenticated administrator. Because the CVSS vector specifies AV:N/AC:L/PR:N/UI:N/S:U with High confidentiality, integrity, and availability impact, the bypass is reachable across the network at low complexity with no prior credentials and no victim interaction, and successful exploitation is scoped to full compromise of the ODI Console - effectively administrative takeover of the product, including access to repository contents and the ability to modify or disrupt integration workloads. Only the two named Fusion Middleware releases (12.2.1.4.0 and 14.1.2.0.0) are affected per the Oracle and EUVD data, so the vulnerable population is bounded to those deployments; note that the provided CPE/version data is limited to the EUVD affected-version list rather than a full CPE inventory, and no CVSS v4 or EPSS score was supplied in this dataset.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes an easily exploitable unauthenticated network HTTP flaw yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as impact stays within the ODI instance.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Data Integrator Console versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical authentication bypass that allows unauthenticated remote attackers to gain full control of the affected deployment, jeopardizing sensitive data integration pipelines and connected enterprise systems. Although no public exploit has been identified at this time and no vendor patch is available, the flaw's automatable nature and total technical impact make it an urgent risk for any organization with internet-facing or broadly accessible ODI Consoles. Leadership must act immediately to reduce exposure because successful exploitation could result in unauthorized access to critical data workflows and downstream systems.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the ODI Console, enforcing VPN or zero-trust segmentation, and enhancing monitoring for authentication bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB