CVE-2026-83397 is a critical (CVSS 9.8) flaw in the Oracle Data Integrator Console / Repository Explorer that lets an unauthenticated attacker with network access take over the product over HTTP.
What Is It
CVE-2026-83397 affects Oracle Data Integrator, part of Oracle Fusion Middleware. The vulnerable component is the Console / Repository Explorer. Oracle calls it "easily exploitable": an unauthenticated attacker with network access over HTTP can compromise Oracle Data Integrator. A successful attack can result in full takeover of the product.
Oracle ([email protected]) submitted the record, and NVD published it on 2026-10-20. The NVD status is currently "Received," which means NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That puts it in the most dangerous class of bugs:
- Network-reachable (AV:N), with low attack complexity (AC:L)
- No privileges (PR:N) and no user interaction (UI:N) required
- High impact to confidentiality, integrity, and availability
The base score is 9.8 (CRITICAL), with an exploitability subscore of 3.9 and an impact subscore of 5.9. Data integration platforms usually hold credentials and connections to many data sources. A takeover of Oracle Data Integrator is therefore a serious exposure for any organization running it on a reachable network.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for CVE-2026-83397, so CISA has not confirmed active exploitation as of this writing. Because the flaw is unauthenticated and low-complexity, it should still be treated as a high priority.
What's Vulnerable
Oracle lists these supported versions of Oracle Data Integrator (Oracle Fusion Middleware) as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The affected component is Console / Repository Explorer. The NVD record does not list any CPE configurations yet.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Administrators should check that advisory for patch availability and fixed versions for Oracle Data Integrator, then apply the relevant updates to affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
There is no CISA KEV entry, so no federal required action or due date applies at this time. Until patches are in place, organizations should check whether the Oracle Data Integrator Console is reachable over HTTP from untrusted networks.
Sources
- NVD, CVE-2026-83397
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)