CVE-2026-83396 is a critical (CVSS 9.8) vulnerability in Oracle Data Integrator. An unauthenticated attacker with network access over RMI can exploit it to take over affected installations.
What Is It
CVE-2026-83396 affects the Console / Repository Explorer component of Oracle Data Integrator, which is part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An unauthenticated attacker who can reach the product over the network via RMI can use it to compromise Oracle Data Integrator.
Oracle reported the issue ([email protected]). NVD published it on October 20, 2026, and its status there is currently "Received."
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network-reachable: an attacker doesn't need local access.
- Low attack complexity: no special conditions are needed.
- No privileges or user interaction required: an attacker needs no credentials and no help from a user.
- High impact to confidentiality, integrity and availability
Oracle says a successful attack can result in takeover of Oracle Data Integrator. Data Integrator usually sits between multiple data sources, so a compromised instance should be treated as a serious exposure.
Exploitation status: No CISA KEV entry was provided for this CVE. Based on the supplied data, active exploitation is not confirmed by KEV right now. That could change if CISA adds the CVE to the catalog.
What's Vulnerable
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle Data Integrator (Oracle Fusion Middleware) | Console / Repository Explorer | 12.2.1.4.0, 14.1.2.0.0 |
Oracle lists these as the affected supported versions. The NVD record had no CPE entries at the time of writing.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory, which is the vendor's source for remediation guidance. Organizations running the affected versions should:
- Review the October 2026 CPU advisory and apply the fix Oracle provides for Oracle Data Integrator.
- Prioritize this update given the critical score and unauthenticated network attack vector.
- Check where the ODI RMI interface is reachable on the network until patching is complete.
No CISA KEV required action or due date applies, because there is no KEV entry for this CVE in the supplied data.