Oracle Data Integrator: Unauthenticated remote takeover in Console / Repository Explorer
Summary
Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Console / Repository Explorer component that is reachable via RMI. An unauthenticated attacker with network access can take over the product, with full impact on confidentiality, integrity and availability. No user interaction or privileges are required. Oracle has released a fix in its October 2026 Critical Patch Update.
Affected
- Oracle Data Integrator 12.2.1.4.0
- Oracle Data Integrator 14.1.2.0.0
Fixed in
- Fix included in the Oracle Critical Patch Update, October 2026.
- Specific patch ID and fixed version: Unknown. Verify in the Oracle advisory or My Oracle Support.
Workaround
- None found. Oracle recommends patching.
- Interim measure (not a vendor recommendation): keep the Data Integrator console and RMI listener off untrusted networks and restrict access to a management VLAN or VPN until patched.
Exploitation
- Exploited in the wild: No evidence found.
- Public proof of concept: None found.
- CISA KEV: Not confirmed.
- EPSS: 0.0045 (low predicted exploitation probability).
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
Our recommendation
- Identify all Data Integrator 12.2.1.4.0 and 14.1.2.0.0 installations, including console and RMI exposure.
- Remove internet exposure of the console and RMI ports immediately.
- Apply the October 2026 Critical Patch Update for Data Integrator from My Oracle Support, confirming the patch ID against the advisory.
- Review logs for unexpected RMI or console access.
- Recheck Oracle's advisory and CISA KEV in the coming weeks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- CVE-2026-83396 vulners record vulners.com
- CVE-2026-83396 Strix www.strix.ai
- Oracle Security Alerts index www.oracle.com
- Oracle blog: October 2026 CPU released blogs.oracle.com
- Waratek: October 2026 CPU waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:16.
Original description (NVD)
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.