The vulnerability resides in the Data Transforms component of Oracle Data Integrator, enabling an unauthenticated attacker with network access through HTTP to gain unauthorized access to the system. Successful exploitation can read critical data and perform unauthorized update, insert, or delete operations on Data Integrator resources, affecting confidentiality and integrity. The CVSS 3.1 base score of 8.2 reflects this high impact.

Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 are susceptible, covering deployments within Oracle Fusion Middleware.

The CVSS score of 8.2 indicates a high severity for confidentiality and integrity damage. The EPSS score of less than 1% suggests that exploit likelihood is low, but the vulnerability remains significant because it requires no authentication and delivers full read/write access over HTTP. With no listing in the CISA KEV catalog, environments that expose Data Integrator’s HTTP interfaces to untrusted networks face a high risk of compromise if the issue is not addressed.