Oracle Data Integrator EUVD-2026-106315

The exposed attack surface is the Oracle Data Integrator Console / Repository Explorer reachable over HTTP; exploitation requires only network access to that web interface. Per the vendor vector (PR:N/UI:N/AC:L) there is no authentication, no user interaction, and no non-default configuration prerequisite stated - default network-exposed ODI Console deployments are at risk. The primary LIMITING factor is network exposure: instances where the ODI Console is restricted to internal/management networks or behind access controls are not remotely reachable by arbitrary attackers. Affected deployments are limited to Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes the worst-case profile: network-reachable over HTTP, low attack complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability loss culminating in product takeover. All three Oracle-defined signals point the same way and are internally consistent with the prose ('Easily exploitable... unauthenticated attacker with network access via HTTP... takeover'). However, several decision signals are MISSING from the input and must not be fabricated: no EPSS exploitation-probability score was supplied, there is no CISA KEV listing, no POC/exploit-code reference, and no SSVC decision record. Exploitation status is therefore 'no public exploit identified at time of analysis' - this is an absence of evidence, not evidence that exploitation is hard. For an unauthenticated 9.8 in Oracle middleware patched in a quarterly CPU, defenders should treat weaponization as a question of time and prioritize patching accordingly. One labeling caveat: the input Tags include 'Information Disclosure', which understates a vulnerability the vendor explicitly calls full 'takeover' (C:H/I:H/A:H) - see confidence_notes.

An attacker with only network reachability to the Oracle Data Integrator Console / Repository Explorer sends a crafted HTTP request to the exposed web interface, requiring no credentials and no user interaction, and leverages the flaw to gain complete control of the ODI instance. Because ODI brokers data-integration jobs and repository credentials, takeover can expose or tamper with connected data stores. No public proof-of-concept or exploit code was identified in the provided intelligence.