Oracle Data Integrator EUVD-2026-46733

Exploitation requires an attacker to hold an active local logon session on the infrastructure host where Oracle Data Integrator executes, with at least low-level OS privileges (PR:L per CVSS). The vulnerable component is specifically the Patchset Assistant, suggesting the flaw may only be triggerable when this utility is accessible on the host - typically present in deployed ODI environments. No network exposure is involved; AV:L confirms this is strictly a local attack. Exploitation is bounded by the requirement for local host access, the absence of any integrity or availability impact, and the limited scope of readable data (a subset of ODI-accessible data, not full system compromise). Remote and unauthenticated attackers cannot exploit this vulnerability. Deployments where ODI hosts are single-user or tightly access-controlled significantly limit realistic risk.

The CVSS 3.1 base score of 3.3 accurately reflects the constrained real-world risk: exploitation is local-only (AV:L), requires low privileges (PR:L), and yields only limited confidentiality impact (C:L) with zero integrity or availability effect (I:N/A:N). No EPSS score was provided in available intelligence, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept exploit code has been identified. The 'Authentication Bypass' tag introduces some ambiguity - it implies a bypass of an access control check, but the description frames this as a low-impact local read issue, not a full authentication circumvention. This discrepancy should be clarified against the full Oracle CPU advisory. In practice, for organizations that enforce least-privilege access to ODI infrastructure hosts - as is standard in enterprise deployments - the realistic attack surface is narrow and limited to malicious or compromised local accounts. This is a maintenance-priority patch, not an emergency response.

An attacker with an existing low-privileged local account on the server running Oracle Data Integrator - such as a disgruntled employee, a shared service account, or a compromised application user - invokes or interacts with the Patchset Assistant component to read ODI configuration data, credentials, or metadata beyond their authorized scope. No network access, no user interaction from a victim, and no elevated OS privileges are required for exploitation. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely.