What is the CVSS score of EUVD-2026-46542?

EUVD-2026-46542 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Data Integrator are affected by EUVD-2026-46542?

Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete system takeover via unauthenticated remote HTTP requests with no public exploit identified at time of analysis.

How to fix or mitigate EUVD-2026-46542?

Within 24 hours: immediately audit all Oracle Data Integrator deployments to identify versions 12.2.1.4.0 and 14.1.2.0.0, isolate affected instances from internet-facing networks, and map all downstream Fusion Middleware product dependencies. Within 7 days: implement network segmentation to restrict REST Service component access to trusted sources only, deploy Web Application Firewall (WAF) rules blocking anomalous HTTP requests to the REST Service, and disable the REST Service component entirely if operationally feasible pending patch availability. Within 30 days: establish continuous monitoring for Oracle's July 2026 Critical Patch Update for ODI, develop a patch deployment plan with change control procedures, and coordinate with Oracle support for any published workarounds or interim guidance.

Oracle Data Integrator EUVD-2026-46542

| CVE-2026-47056 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-42vm-5c82-p5wp

Authentication Bypass Oracle Oracle Data Integrator Oracle Corporation

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Oracle confirms easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N) with product takeover and impact on other products, justifying S:C and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:15 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Data Integrator (ODI) is Oracle's enterprise ELT/data-integration platform built on Oracle Fusion Middleware and typically deployed on Oracle WebLogic Server. The flaw resides in the REST Service component, an HTTP-exposed API surface of ODI. The CPE cpe:2.3:a:oracle_corporation:oracle_data_integrator identifies the affected product line. Oracle did not assign a specific CWE (CWE: N/A), but the combination of pre-authentication access, full CIA impact, and a scope change through an HTTP-facing REST endpoint is characteristic of an authentication-bypass or unauthenticated remote code execution/deserialization class of weakness common to WebLogic/Fusion Middleware REST layers, where the compromised component runs with privileges that extend into the surrounding middleware stack.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update immediately; the primary remediation is installing the CPU patch for the affected ODI releases 12.2.1.4.0 and 14.1.2.0.0 as directed at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - no standalone fixed version string is enumerated beyond the CPU). Oracle does not publish granular pre-patch workarounds for CPU items, so until patching is complete, apply compensating controls: restrict network access to the ODI REST Service endpoint using firewall or reverse-proxy allow-lists so only trusted management hosts can reach it (trade-off: may break legitimate REST-based integrations and automation), remove ODI REST/console exposure from any internet-facing path, and place the middleware behind a WAF tuned to inspect the REST API (trade-off: signature coverage for a novel unauthenticated flaw may be incomplete). Increase monitoring of HTTP access logs on the REST Service for anomalous unauthenticated requests as a detective control until the patch is applied.