Oracle Data Integrator EUVD-2026-106314

Exploitation requires network access to the Oracle Data Integrator RMI listener servicing the Console / Repository Explorer component on an affected version (12.2.1.4.0 or 14.1.2.0.0); no authentication, no privileges, and no user interaction are needed (PR:N/UI:N). The primary limiting factor is exposure of the RMI (T3-style) endpoint: if the RMI port is firewalled or confined to an internal management segment, remote reachability - and thus exploitability - is substantially reduced. There is no indication that a non-default feature or special configuration must be enabled; the flaw affects the standard Console/Repository Explorer RMI interface.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, resulting in full confidentiality, integrity, and availability loss - i.e., complete product takeover, consistent with the Oracle description. Several signals are absent from the provided intelligence: there is no EPSS exploitation-probability score, no SSVC decision data, no CISA KEV listing, and no indication of public exploit code, so the exploitation picture must be inferred from the CVSS vector alone rather than from observed activity. The one notable tension is that the input Tags label this 'Information Disclosure', which understates the actual impact - the description and the C:H/I:H/A:H metrics indicate full takeover, not mere disclosure; defenders should treat it as a takeover-class flaw. The RMI attack vector is the key real-world mitigant: exploitation depends on the Oracle Data Integrator RMI listener being reachable from the attacker, which in many deployments is network-segmented rather than internet-facing, so blast radius in practice is governed by exposure of the RMI/T3 port rather than by the raw 9.8 score.

An attacker with network reach to the Oracle Data Integrator RMI listener sends a crafted RMI request to the Console / Repository Explorer component without any credentials or user interaction. Because the flaw is low-complexity and unauthenticated, a single successful request yields full compromise and takeover of the ODI instance. No public exploit code is identified in the provided data, so this scenario is derived from the CVSS vector rather than an observed exploit.