The vulnerability allows an unauthenticated attacker with network access to the Oracle Data Integrator Console/Repository Explorer to gain complete control of the system, compromising confidentiality, integrity, and availability. The flaw is triggered over HTTP and does not require any prior authentication, meaning a remote host can exploit it directly. The associated CVSS 3.1 score of 9.8 reflects the full compromise potential.

Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These versions are part of Oracle Fusion Middleware and are widely deployed in enterprise data integration environments.

With a Base Score of 9.8 the risk is high and the threat landscape is amplified by the lack of authentication requirements for exploitation. The EPSS score is <1%, and the vulnerability is not yet listed in the CISA KEV catalog, but the remote nature and high severity make it attractive for adversaries. Attackers can reach the exposed HTTP endpoint from any network host, execute arbitrary code, and take over the service.