CVE-2026-35262: Oracle Data Integrator Authentication Bypass – Data Exposure Risk

Technical summary

CVE-2026-35262 is a privilege escalation and data access vulnerability in the Market Place component of Oracle Data Integrator. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability stems from improper access controls (CWE-284) in the HTTP interface, allowing low-privileged authenticated users to bypass authorization checks. Exploitation requires valid network credentials but no UI interaction. The attack vector is network-based with low complexity, resulting in high confidentiality and integrity impact, plus limited availability impact.

Business impact

Organizations running affected Oracle Data Integrator instances face substantial risk of data compromise. Depending on deployment scope, attackers could exfiltrate sensitive business data, corrupt ETL job definitions and metadata, or manipulate integrated data pipelines without detection. For enterprises using ODI to manage customer data, financial records, or operational intelligence, unauthorized modification represents a regulatory and operational liability. Partial denial of service could interrupt scheduled data integration workflows.

Affected systems

Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 running as part of Oracle Fusion Middleware are vulnerable. Any deployment of these versions exposed to network access from authenticated users—whether internal staff, contractors, or compromised service accounts—is at immediate risk. Organizations should audit their Oracle middleware asset inventory to identify instances, assess whether they contain sensitive data, and prioritize those for patching.

Exploitability

Exploitation is rated 'easily exploitable' by Oracle. It requires an attacker to hold valid credentials (low privilege level acceptable) and network connectivity to the HTTP interface. Once authenticated, no additional social engineering, user interaction, or complex technical steps are needed. The low attack complexity and authenticated-only requirement place this in the middle of the risk spectrum—more constrained than unauthenticated flaws, but still actionable by insiders, compromised accounts, or lateral movement within the network.

Remediation

Organizations must apply security patches from Oracle as soon as they become available for versions 12.2.1.4.0 and 14.1.2.0.0. Until patched, isolate or air-gap affected Oracle Data Integrator systems from untrusted networks, implement strict network segmentation to limit HTTP access to the application, and enforce strong authentication and least-privilege access controls. Monitor service accounts and revoke unnecessary credentials. Consider temporarily disabling non-critical ODI jobs if service continuity permits.

Patch guidance

Consult Oracle's official security advisory for CVE-2026-35262 to obtain the correct patch version for each affected release (12.2.1.4.0 and 14.1.2.0.0). Oracle typically releases patches through the Oracle Critical Patch Update (CPU) program. Test patches in a non-production environment before deployment, as Oracle Data Integrator patches may impact ETL jobs and dependent systems. Verify patch success by checking the installed version and reviewing Oracle's advisories for post-patch validation steps.

Detection guidance

Monitor HTTP access logs to Oracle Data Integrator for anomalous authentication patterns, especially from unusual source IPs or service accounts accessing Market Place endpoints. Use application-level logging to track data creation, modification, and deletion operations—look for bulk changes by low-privilege accounts or access to sensitive tables outside normal business hours. Network intrusion detection signatures targeting Market Place component exploitation (once available from vendors like Snort or Suricata communities) should be deployed upstream of the application. Correlate ODI activity logs with identity and access management (IAM) systems to spot credential misuse.

Why prioritize this

This vulnerability merits high priority due to the combination of high CVSS score (8.3), ease of exploitation, and direct impact on data confidentiality and integrity. Unlike many network-based flaws, it does not require zero-day techniques or user interaction; any authenticated user is a potential vector. For organizations where Oracle Data Integrator handles customer data, financial records, or intellectual property, compromise could trigger data breach notification requirements, regulatory fines, and reputational harm. Even organizations with less sensitive data should prioritize patching to prevent lateral movement or insider abuse.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects three key factors: (1) High confidentiality impact—authenticated attackers can read all accessible ODI data; (2) High integrity impact—attackers can modify or delete critical business data and metadata; (3) Low availability impact—attackers can cause partial denial of service, disrupting but not completely halting the service. The network attack vector and low attack complexity elevate the score, while the requirement for low-level authentication slightly constrains it. The unchanged scope (U) indicates impact is limited to the ODI component itself, not the broader system.

Frequently asked questions