---
id: "CVE-2026-83397"
kind: "vulnerability"
aliases: ["CVE-2026-83397"]
title: "Oracle Data Integrator: unauthenticated HTTP flaw lets attackers take over"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Data Integrator", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-data-integrator", "oracle-fusion-middleware", "other", "runtime", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T22:19:56+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:05:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83397", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:05:13+00:00"}]
---

# Oracle Data Integrator: unauthenticated HTTP flaw lets attackers take over

Oracle Data Integrator (Fusion Middleware), Console / Repository Explorer component: an unauthenticated attacker with HTTP access can take over the instance. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). Fixed in Oracle's October 2026 Critical Patch Update (published 2026-10-20). No exploitation in the wild reported as of now.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Data Integrator affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Check your ODI version: 12.2.1.4.0 and 14.1.2.0.0 are affected. Run OPatch lsinventory in the ODI Oracle home and compare against the October 2026 CPU patch for ODI. Check whether the ODI Console / Repository Explorer web application is reachable from untrusted networks.

## Fix

Apply the October 2026 Oracle CPU patch for Oracle Data Integrator, downloaded from My Oracle Support. Oracle gives no fixed version string in the advisory text, so the patch ID is unknown; look it up in the CPU's Fusion Middleware patch availability document. Until you patch, block access to the ODI Console and Repository Explorer at the firewall or load balancer.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83397
- 2026-10-23T23:05:13+00:00 analyst — Oracle CNA record (cve.org) and the Oct 2026 CPU confirm CVSS 9.8, affected ODI 12.2.1.4.0 and 14.1.2.0.0. I could not read the CPU risk matrix itself (the saved page was outside my allowed paths), so patch IDs and default exposure are unconfirmed. No X posts, no KEV listing, no public PoC found.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-83397 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-83397
- [mitigation] Armis: CVE-2026-83397 https://cve.armis.com/CVE-2026-83397

## From the sources

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_