---
id: "CVE-2026-83396"
kind: "vulnerability"
aliases: ["CVE-2026-83396"]
title: "Oracle Data Integrator: unauthenticated RMI access lets attackers take over"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Data Integrator", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "oracle-data-integrator", "oracle-fusion-middleware", "other", "rmi", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:19:56+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:05:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83396", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:05:03+00:00"}]
---

# Oracle Data Integrator: unauthenticated RMI access lets attackers take over

Oracle Data Integrator's Console and Repository Explorer, in versions 12.2.1.4.0 and 14.1.2.0.0, can be compromised over the network via RMI without logging in. A successful attacker gets full takeover of the Data Integrator instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Data Integrator affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Check whether you run Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0, for example with OPatch lsinventory in the ODI Oracle home. Then check whether the ODI Console or Repository Explorer RMI listener is reachable from untrusted networks, for example by scanning the host with nmap. The default RMI port is not stated in the sources; unknown.

## Fix

Apply the Oracle Fusion Middleware patch for Oracle Data Integrator from the October 2026 Critical Patch Update (12.2.1.4.0 and 14.1.2.0.0 are both affected). The exact patch number is in the MOS Fusion Middleware Patch Availability Document, which needs a My Oracle Support login. Until patched, block network access to the ODI RMI ports.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83396
- 2026-10-23T23:05:03+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) lists ODI 12.2.1.4.0 and 14.1.2.0.0, patch via Fusion Middleware patch doc (MOS, login needed; exact patch number not read). CVSS 9.8 per CVE record. No exploitation or PoC found (Armis: not in KEV). Default RMI exposure not confirmed by any source. Sibling CVE-2026-83397 is being researched separately. Did not search social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-83396 https://www.cve.org/CVERecord?id=CVE-2026-83396

## From the sources

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_