Oracle Data Integrator EUVD-2026-46734

Exploitation requires local logon access (interactive or non-interactive shell) to the host operating system where Oracle Data Integrator is installed - the attack vector is strictly local (AV:L), and remote network-only access is insufficient to exploit this vulnerability. The attacker must hold a low-privileged account on that host (PR:L); anonymous or unauthenticated remote attackers cannot exploit this directly. The vulnerable component is specifically the Patchset Assistant within ODI versions 12.2.1.4.0 or 14.1.2.0.0 - other ODI versions are not listed as affected. No user interaction is required once local access is established. Key limiting factors are local host access controls: environments where only trusted administrators have shell access to the ODI server are not practically exploitable. The scope change (S:C) indicates successful exploitation may extend impact to other Oracle Fusion Middleware components or connected integration targets beyond ODI itself.

The CVSS 3.1 base score of 6.5 reflects a medium-severity finding driven primarily by the local attack vector (AV:L) and high confidentiality impact (C:H), with scope change (S:C) amplifying downstream exposure. The local-only attack vector is the dominant risk-limiting factor: an attacker must already possess interactive logon access to the host OS running ODI, which substantially narrows the exploitable population compared to network-accessible vulnerabilities. No EPSS score was provided in the source data, KEV listing has not been confirmed (no CISA KEV entry present), and no POC or public exploit code has been identified at time of analysis. The 'Authentication Bypass' tag creates a minor signal conflict with PR:L - a true authentication bypass typically implies PR:N; this discrepancy may indicate the bypass operates at the ODI application authorization layer rather than at OS authentication, meaning an OS account is still required. The scope change designation is the most significant risk amplifier: ODI environments typically broker access to sensitive enterprise data sources, so credential or configuration theft through ODI could enable lateral movement into connected systems. Real-world priority is moderate for organizations where non-administrative users have local shell access to ODI infrastructure hosts; organizations with strict host access controls face materially lower effective risk.

An attacker with a low-privileged account on the host server running Oracle Data Integrator - such as a service account, developer account, or compromised application account with local logon rights - interacts with the Patchset Assistant component and exploits its authorization bypass to assume elevated read privileges within the ODI runtime. The attacker exfiltrates ODI repository contents, including integration metadata, connection pool credentials, and potentially plaintext or weakly protected credentials for connected source and target data systems, then uses those credentials to access downstream enterprise databases or data warehouses outside ODI's own perimeter.