Oracle Data Integrator EUVD-2026-47067

Exploitation requires the attacker to have local logon access (AV:L) to the infrastructure/host where Oracle Data Integrator executes and to hold a low-privilege account (PR:L) - it is not remotely exploitable over the network and needs no user interaction (UI:N) and low attack complexity (AC:L). The specific attack surface is the Market Place component of ODI versions 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce real-world risk: the mandatory local foothold and valid low-privilege credentials mean an unauthenticated or purely remote attacker cannot exploit this directly; environments that strictly isolate ODI hosts and limit local accounts are substantially harder to attack. The scope change (S:C) is an aggravating condition, allowing impact to extend beyond ODI to additional products.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a locally-accessible, low-complexity attack requiring low privileges and no user interaction, yielding high confidentiality and integrity impact with a scope change - hence the elevated 8.4 score despite the local attack vector. The requirement to already 'log on to the infrastructure where Oracle Data Integrator executes' (AV:L, PR:L) meaningfully limits exposure: this is not remotely reachable from the network, so an attacker must first obtain a foothold or a low-privilege account on the ODI host. No EPSS score, KEV entry, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified from the input; the practical risk is real for multi-tenant or shared ODI environments where many users hold low-privilege local accounts, but lower for tightly isolated single-operator deployments. The 'Authentication Bypass' tag and scope change are the key aggravating signals and warrant prompt patching in shared environments.

An attacker holding a low-privilege account on the server where Oracle Data Integrator runs authenticates locally and abuses the Market Place component's flawed authorization to bypass access controls, then reads and tampers with all ODI-accessible data and pivots into other products affected by the scope change. Because attack complexity is low and no user interaction is required, a single logged-on insider or a foothold from a prior compromise is sufficient; no public exploit was identified at time of analysis, so any attack would rely on private tooling or manual abuse.