This vulnerability is located in the Console / Repository Explorer component of Oracle Data Integrator. An unauthenticated attacker with network access through RMI can gain full control of the application, leading to a complete takeover of the service. The weakness allows unrestricted RMI communication without any authentication or authorization checks, which results in simultaneous breaches of confidentiality, integrity, and availability. The problem is classified as an improper access control flaw that permits remote exploitation via the RMI interface.

Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The flaw resides in the Console / Repository Explorer component of the Oracle Fusion Middleware suite.

The CVSS v3.1 base score of 9.8 indicates critical severity. Attackers need no credentials; a single network connection to the exposed RMI port is sufficient to compromise the system. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA KEV, so exposure risk is driven largely by the high CVSS score and the ability for unauthenticated attackers to achieve takeover. Based on the description, it is inferred that the vulnerability arises from an improper access control flaw that allows unrestricted RMI communication without authentication.