CVE-2026-47056 in Data Integrator
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Data Integrator component known as Rest Service in Oracle Fusion Middleware, affecting specifically versions 12.2.1.4.0 and 14.1.2.0.0. The flaw represents a critical security weakness that allows unauthenticated attackers to exploit the system through standard HTTP network connections without requiring any prior authentication credentials or privileged access. The vulnerability's classification as easily exploitable indicates that the attack vector requires minimal technical expertise or resources, making it particularly dangerous in production environments where such services may be exposed to external networks.
The technical nature of this vulnerability stems from inadequate authentication mechanisms within the Rest Service component, which fails to properly validate incoming requests before processing them. This allows attackers to directly interact with the service endpoints and potentially execute malicious operations against the targeted Oracle Data Integrator instance. The CVSS 3.1 base score of 10.0 reflects the severity of impact across all three core security principles: confidentiality, integrity, and availability. The attack vector AV:N indicates network-based exploitation is possible, while AC:L demonstrates low attack complexity requirements, making this vulnerability accessible to a broad range of threat actors including automated tools.
The operational impact of successful exploitation extends beyond the immediate compromise of Oracle Data Integrator itself, as indicated by the scope change aspect of this vulnerability. This means that an attacker who successfully compromises the Data Integrator service may be able to leverage the access gained to impact other interconnected systems or applications within the broader Oracle Fusion Middleware ecosystem. The high confidentiality, integrity, and availability impacts suggest that attackers could potentially extract sensitive data, modify critical business processes, or completely disrupt operations across multiple dependent services.
Organizations should immediately implement mitigations including network segmentation to restrict access to Oracle Data Integrator Rest Services only to authorized networks, disabling unnecessary HTTP endpoints, and applying available patches from Oracle as soon as they become available. The vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in remote services. Additional defensive measures should include implementing robust network monitoring to detect unusual access patterns, deploying web application firewalls to filter malicious requests, and conducting comprehensive vulnerability assessments of all Oracle Fusion Middleware components to identify similar weaknesses that may exist within the broader infrastructure ecosystem.