CVE-2026-83232
CRITICAL · 9.8Real critical vuln published yesterday; no KEV, PoC, or active exploitation chatter yet.
What: Unauthenticated remote code execution in Oracle Data Integrator Console (versions 12.2.1.4.0, 14.1.2.0.0) via HTTP; CVSS 9.8 CRITICAL.
Why it matters: Published 16 hours ago; CVSS 9.8 severity with no authentication required and network-accessible attack vector. However, not yet KEV-listed, and no public PoC or confirmed in-the-wild exploitation chatter observed. Oracle likely issuing urgent patch guidance imminently given criticality window.
Where it's seen: Social posts amplifying NVD description with alarm emoji; hyperlinks to CVE aggregators but no PoC repositories, proof-of-concept code, or defender triage questions yet.
RISK: CRITICAL — Unauthenticated remote takeover of Oracle Fusion Middleware product; 9.8 CVSS.
Description
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High