Oracle Data Integrator EUVD-2026-106316

No special configuration conditions are stated - exploitation targets the Data Transforms component of Oracle Data Integrator and, per the CVSS vector (AV:N/AC:L/PR:N/UI:N), requires only network access to the ODI HTTP interface against affected versions 12.2.1.4.0 and 14.1.2.0.0, with no authentication and no user interaction. The primary limiting factor is network reachability: the ODI/Data Transforms HTTP endpoint must be accessible to the attacker, so instances segmented behind internal networks or restricted to trusted management subnets are substantially less exposed than internet- or broadly-reachable deployments. No specific non-default feature toggle is named in the Oracle description as a prerequisite.

This is a genuine high-priority network-facing exposure, though not the top tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is the strongest signal: exploitation is remote over HTTP, low-complexity, requires no privileges and no user interaction, which places it in the 'trivially reachable by any network attacker' category. Impact is skewed toward data exposure - Confidentiality is High (unauthorized access to all ODI-accessible data) while Integrity is only Low (partial update/insert/delete) and Availability is None, consistent with the 8.2 base score rather than a full 9.8 RCE. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or imminent exploitation; the risk is driven by exploitability characteristics, not by observed in-the-wild activity. One data conflict to flag explicitly: the input Tags label this 'Authentication Bypass,' but neither the Oracle description nor the CVSS vector describes bypassing an authentication control - the flaw is simply unauthenticated-reachable (PR:N). Treat the 'Authentication Bypass' classification as unverified. Priority: patch promptly on internet- or network-exposed ODI instances given the pre-auth network vector and High confidentiality impact, but absent EPSS/KEV/POC signals this does not rise to drop-everything emergency status.

An unauthenticated attacker with network access to an Oracle Data Integrator instance sends a crafted HTTP request to the Data Transforms component and, without any credentials or user interaction, reads critical data across ODI-accessible stores and performs limited unauthorized writes (insert/update/delete) to some data. No public exploit code is referenced in the available data, so exploitation would currently require independent research. The low attack complexity means a working exploit, once developed, would be reliable against affected default deployments.