CVE-2026-35262 Overview
CVE-2026-35262 is a high-severity vulnerability in the Oracle Data Integrator (ODI) product of Oracle Fusion Middleware, located in the Market Place component. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the flaw to compromise Oracle Data Integrator. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, full read access to all ODI-accessible data, and partial denial of service. The weakness maps to [CWE-284] Improper Access Control.
Critical Impact
Authenticated attackers can read, modify, and destroy data across Oracle Data Integrator and cause partial service disruption over the network.
Affected Products
- Oracle Data Integrator 12.2.1.4.0
- Oracle Data Integrator 14.1.2.0.0
- Component: Market Place (Oracle Fusion Middleware)
Discovery Timeline
- 2026-06-17 - CVE-2026-35262 published to NVD
- 2026-06-17 - Oracle Security Alert June 2026 released
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-35262
Vulnerability Analysis
The vulnerability resides in the Market Place component of Oracle Data Integrator and stems from improper access control. An attacker with low-level credentials can issue crafted HTTP requests to reach functionality that should be restricted. The flaw does not require user interaction and has low attack complexity, making it practical to exploit at scale within reachable networks.
Successful exploitation yields high impact on confidentiality and integrity. Attackers can read all ODI-accessible data and create, modify, or delete critical records. Availability impact is limited to partial denial of service, meaning the attacker can degrade but not fully take down the ODI service.
Root Cause
The defect is classified under [CWE-284] Improper Access Control. The Market Place component fails to enforce sufficient authorization checks on actions reachable from authenticated low-privilege sessions. Server-side validation gaps let attackers operate on data and functions beyond their granted role boundaries.
Attack Vector
The attack vector is the network. An attacker authenticates with low privileges to the ODI HTTP interface and submits requests that target the Market Place component. Because the scope is unchanged and no user interaction is required, the attacker drives the entire exploitation flow programmatically. No public proof-of-concept code or exploitation in the wild is currently reported. Refer to the Oracle Security Alert June 2026 for vendor-supplied technical context.
Detection Methods for CVE-2026-35262
Indicators of Compromise
- Unexpected HTTP requests to Oracle Data Integrator Market Place endpoints originating from low-privilege accounts.
- Anomalous create, update, or delete operations against ODI repository objects outside normal change windows.
- Surges in failed or partial ODI service responses indicating partial denial of service attempts.
- Authentication events from unusual source IPs preceding administrative-style actions in ODI logs.
Detection Strategies
- Baseline normal Market Place API usage per user role and alert on deviations such as bulk modifications by non-admin users.
- Correlate ODI application logs, WebLogic access logs, and database audit logs to reconstruct sequences of privileged actions performed by low-privilege identities.
- Monitor for repeated 4xx/5xx responses on ODI HTTP endpoints, which can indicate probing.
Monitoring Recommendations
- Forward ODI, WebLogic, and reverse-proxy logs into a centralized analytics platform such as Singularity Data Lake for OCSF-normalized correlation and historical retention.
- Enable database-level auditing on ODI repository schemas to capture unauthorized data modifications.
- Track outbound network traffic from ODI servers to identify post-exploitation data staging.
How to Mitigate CVE-2026-35262
Immediate Actions Required
- Apply the patches from the Oracle Security Alert June 2026 to all Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 deployments.
- Inventory exposed ODI instances and restrict the HTTP management surface to trusted network segments.
- Rotate credentials for low-privilege ODI accounts and review their entitlements.
- Audit recent ODI activity for evidence of unauthorized data changes since the last known-good backup.
Patch Information
Oracle published fixes in the June 2026 security update cycle. Administrators should consult the Oracle Security Alert June 2026 for the exact patch bundle, prerequisite versions, and installation order for affected Oracle Data Integrator releases.
Workarounds
- Place ODI behind a network proxy or VPN that restricts HTTP access to authenticated administrative users only.
- Disable or block external exposure of the Market Place component if it is not required for production workflows.
- Apply the principle of least privilege by removing unnecessary low-privilege accounts that can reach ODI HTTP endpoints.
# Example: restrict ODI HTTP access at the network edge
# Allow only management subnet to reach ODI on port 8001
iptables -A INPUT -p tcp --dport 8001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
