A critical, unauthenticated remote code execution vulnerability in Oracle Data Integrator enables complete system compromise and potential lateral movement via scope change.

This is a critical vulnerability within the Rest Service component that permits an unauthenticated attacker, with network access via HTTP, to execute arbitrary commands and achieve a full system takeover.

The vulnerability carries a CVSS base score of 10.0, representing the highest level of severity. Successful exploitation grants an attacker full control over the affected Oracle Data Integrator instance, leading to total loss of confidentiality, integrity, and availability. Due to the scope change, the compromise may extend beyond the application to impact broader infrastructure components within the Oracle Fusion Middleware environment.

Immediate Action: Apply the relevant security patches provided in the July 2026 Oracle Critical Patch Update immediately.

Proactive Monitoring: Monitor network ingress traffic to the Rest Service component for unusual HTTP requests, and review system logs for unauthorized administrative access or unexpected process execution.

Compensating Controls: Implement strict network segmentation and restrict access to the affected service via a Web Application Firewall (WAF) or ingress controller to block malicious payloads.

Public Exploit Available: No confirmed public exploit available.

Given the critical CVSS score and the ease of exploitation for unauthenticated actors, this vulnerability poses an immediate and severe threat to the organization. Administrators must prioritize the application of the official Oracle security updates to prevent unauthorized system takeover.