{"id":"CVE-2026-83397","kind":"vulnerability","aliases":["CVE-2026-83397"],"related":[],"title":"Oracle Data Integrator: unauthenticated HTTP flaw lets attackers take over","description":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Data Integrator (Fusion Middleware), Console / Repository Explorer component: an unauthenticated attacker with HTTP access can take over the instance. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). Fixed in Oracle's October 2026 Critical Patch Update (published 2026-10-20). No exploitation in the wild reported as of now.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Data Integrator","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-data-integrator","oracle-fusion-middleware","other","runtime","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Check your ODI version: 12.2.1.4.0 and 14.1.2.0.0 are affected. Run OPatch lsinventory in the ODI Oracle home and compare against the October 2026 CPU patch for ODI. Check whether the ODI Console / Repository Explorer web application is reachable from untrusted networks.","fix":"Apply the October 2026 Oracle CPU patch for Oracle Data Integrator, downloaded from My Oracle Support. Oracle gives no fixed version string in the advisory text, so the patch ID is unknown; look it up in the CPU's Fusion Middleware patch availability document. Until you patch, block access to the ODI Console and Repository Explorer at the firewall or load balancer.","status":"open","published_at":"2026-10-20T22:19:56+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:44+00:00","updated_at":"2026-10-23T23:05:13+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Data Integrator: unauthenticated HTTP flaw lets attackers take over","impact":"high","summary":"Oracle Data Integrator's Console and Repository Explorer component, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that an unauthenticated attacker can reach over the network via HTTP. Successful exploitation gives the attacker full takeover of the Data Integrator instance.","category":"runtime","who_cares":["oracle-data-integrator","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over Data Integrator, gaining full read, write and availability control","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-83397 (https://nvd.nist.gov/vuln/detail/CVE-2026-83397) for patch versions and whether the Console is exposed by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000519,"input_tokens":3095,"output_tokens":419,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-83397 (https://nvd.nist.gov/vuln/detail/CVE-2026-83397) for patch versions and whether the Console is exposed by default.","search":"'-10':71B '-20':72B '-2026':11A,14A '-83397':12A,15A '/av':146C '12.2.1.4.0':100C '14.1.2.0.0':102C '2026':65B,70B '3.1':53B,133C,145C '9.8':54B,136C 'access':46B,111C 'affect':98C 'allow':106C 'attack':8A,43B,108C,120C 'av':55B 'avail':140C 'base':134C 'compon':40B,90C 'compromis':115C 'confidenti':137C 'consol':37B,91C 'critic':66B 'cve':10A,13A 'cvss':52B,132C,142C,144C 'data':2A,17A,21B,33B,83C,117C,130C 'easili':103C 'exploit':74B,104C 'explor':39B,93C 'fix':60B 'flaw':6A 'fusion':25B,35B,88C 'h':154C 'h/a':153C 'h/i':152C 'host':31B 'http':5A,45B,113C 'impact':141C 'instanc':51B 'integr':3A,22B,34B,84C,118C,131C,138C 'integrator':18A 'l/pr':57B,148C 'let':7A 'middlewar':26B,36B,89C 'n':59B 'n/ac':56B,147C 'n/s':150C 'n/ui':58B,149C 'network':110C 'octob':64B 'oracl':1A,20B,24B,32B,62B,82C,87C,116C,129C 'oracle':16A 'oracle-data-integr':19B 'oracle-fusion-middlewar':23B 'patch':67B 'product':85C 'publish':69B 'report':78B 'repositori':38B,92C 'result':125C 'runtim':28B 'score':135C 'self':30B 'self-host':29B 'success':119C 'support':94C 'take':9A,48B 'takeov':127C 'u/c':151C 'unauthent':4A,42B,107C 'updat':68B 'vector':143C 'version':95C 'via':112C 'vulner':79C,105C,123C 'wild':77B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83397","severity":null,"published_at":"2026-10-20T22:19:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83397:361","url":null,"severity":null,"published_at":"2026-10-23T23:05:13+00:00","modified_at":"2026-10-23T23:05:13+00:00","first_seen_at":"2026-10-23T23:05:13+00:00","fetched_at":"2026-10-23T23:05:13+00:00","note":"Oracle CNA record (cve.org) and the Oct 2026 CPU confirm CVSS 9.8, affected ODI 12.2.1.4.0 and 14.1.2.0.0. I could not read the CPU risk matrix itself (the saved page was outside my allowed paths), so patch IDs and default exposure are unconfirmed. No X posts, no KEV listing, no public PoC found."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1771,"url":"https://www.cve.org/CVERecord?id=CVE-2026-83397","title":"CVE Record: CVE-2026-83397 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1772,"url":"https://cve.armis.com/CVE-2026-83397","title":"Armis: CVE-2026-83397","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}