{"id":"CVE-2026-83396","kind":"vulnerability","aliases":["CVE-2026-83396"],"related":[],"title":"Oracle Data Integrator: unauthenticated RMI access lets attackers take over","description":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Data Integrator's Console and Repository Explorer, in versions 12.2.1.4.0 and 14.1.2.0.0, can be compromised over the network via RMI without logging in. A successful attacker gets full takeover of the Data Integrator instance.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Data Integrator","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","oracle-data-integrator","oracle-fusion-middleware","other","rmi","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Check whether you run Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0, for example with OPatch lsinventory in the ODI Oracle home. Then check whether the ODI Console or Repository Explorer RMI listener is reachable from untrusted networks, for example by scanning the host with nmap. The default RMI port is not stated in the sources; unknown.","fix":"Apply the Oracle Fusion Middleware patch for Oracle Data Integrator from the October 2026 Critical Patch Update (12.2.1.4.0 and 14.1.2.0.0 are both affected). The exact patch number is in the MOS Fusion Middleware Patch Availability Document, which needs a My Oracle Support login. Until patched, block network access to the ODI RMI ports.","status":"open","published_at":"2026-10-20T22:19:56+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:45+00:00","updated_at":"2026-10-23T23:05:03+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:34:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Data Integrator: unauthenticated RMI access lets attackers take over","impact":"high","summary":"Oracle Data Integrator's Console and Repository Explorer, in versions 12.2.1.4.0 and 14.1.2.0.0, can be compromised over the network via RMI without logging in. A successful attacker gets full takeover of the Data Integrator instance.","category":"infrastructure","who_cares":["oracle-data-integrator","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over Data Integrator and its connected data.","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and check whether the RMI port is exposed by default; sources do not give a fix version or a detection step.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000495,"input_tokens":3094,"output_tokens":371,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and check whether the RMI port is exposed by default; sources do not give a fix version or a detection step.","search":"'-2026':11A,14A '-83396':12A,15A '/av':135C '12.2.1.4.0':43B,89C '14.1.2.0.0':45B,91C '3.1':122C,134C '9.8':125C 'access':6A,100C 'affect':87C 'allow':95C 'attack':8A,59B,97C,109C 'avail':129C 'base':123C 'compon':79C 'compromis':48B,104C 'confidenti':126C 'consol':37B,80C 'cve':10A,13A 'cvss':121C,131C,133C 'data':2A,17A,22B,34B,65B,72C,106C,119C 'easili':92C 'exploit':93C 'explor':40B,82C 'full':61B 'fusion':26B,77C 'get':60B 'h':143C 'h/a':142C 'h/i':141C 'host':32B 'impact':130C 'infrastructur':19B 'instanc':67B 'integr':3A,23B,35B,66B,73C,107C,120C,127C 'integrator':18A 'l/pr':137C 'let':7A 'log':55B 'middlewar':27B,78C 'n/ac':136C 'n/s':139C 'n/ui':138C 'network':51B,99C 'oracl':1A,21B,25B,33B,71C,76C,105C,118C 'oracle':16A 'oracle-data-integr':20B 'oracle-fusion-middlewar':24B 'product':74C 'repositori':39B,81C 'result':114C 'rmi':5A,29B,53B,102C 'score':124C 'self':31B 'self-host':30B 'success':58B,108C 'support':83C 'take':9A 'takeov':62B,116C 'u/c':140C 'unauthent':4A,96C 'vector':132C 'version':42B,84C 'via':52B,101C 'vulner':68C,94C,112C 'without':54B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83396","severity":null,"published_at":"2026-10-20T22:19:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83396:362","url":null,"severity":null,"published_at":"2026-10-23T23:05:03+00:00","modified_at":"2026-10-23T23:05:03+00:00","first_seen_at":"2026-10-23T23:05:03+00:00","fetched_at":"2026-10-23T23:05:03+00:00","note":"Oracle CPU Oct 2026 (Oct 20) lists ODI 12.2.1.4.0 and 14.1.2.0.0, patch via Fusion Middleware patch doc (MOS, login needed; exact patch number not read). CVSS 9.8 per CVE record. No exploitation or PoC found (Armis: not in KEV). Default RMI exposure not confirmed by any source. Sibling CVE-2026-83397 is being researched separately. Did not search social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1765,"url":"https://www.cve.org/CVERecord?id=CVE-2026-83396","title":"CVE Record: CVE-2026-83396","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}