CVE-2026-47056
CRITICALOracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 - Unauthenticated Remote Code Execution via REST Service
Title source: llmDescription
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
Oracle Advisory
https://www.oracle.com/security-alerts/cpujul2026.html
Scores
CVSS v3
10.0
EPSS
0.0035
EPSS Percentile
28.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-306
Status
published
Products (4)
oracle/data_integrator
12.2.1.4.0
oracle/data_integrator
14.1.2.0.0
Oracle Corporation/Oracle Data Integrator
12.2.1.4.0
Oracle Corporation/Oracle Data Integrator
14.1.2.0.0
Published
Jul 21, 2026
Tracked Since
Jul 22, 2026