CVE-2026-83232

Oracle Data Integrator, a component of Oracle Fusion Middleware, contains an easily exploitable flaw in the Console / Repository Explorer component that allows an unauthenticated attacker with network access over HTTP to fully compromise the product. Successful exploitation results in complete takeover of Oracle Data Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0, meaning organizations running current releases on those branches are exposed. Any instance whose Console or Repository Explorer is reachable by an attacker — particularly if internet-exposed — is at risk. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the CVE is not on the CISA KEV list, though the unauthenticated, network-exploitable nature makes it a high-priority patch target.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83232 if you run Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0. Until patched, restrict network access to the ODI Console and Repository Explorer (allow-list trusted hosts, require VPN/authentication at a reverse proxy) and verify these endpoints are not exposed to the internet. Review Console and Repository Explorer access logs for unexplained or unauthenticated activity as an indicator of attempted exploitation.