CVE-2026-35262: Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place)

Synopsis

An access-control vulnerability in the Market Place component of Oracle Data Integrator (part of Oracle Fusion Middleware) allows a low-privileged attacker to reach the service over HTTP and compromise the product. No victim interaction is needed, and the exploit is reliable and condition-free. Successful exploitation gives the attacker full read and write access to all Oracle Data Integrator data, plus the ability to partially disrupt service availability. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Data Integrator Market Place component over a network via HTTP; local or physical access is not required.

• AuthenticationRequired

  A valid account is needed, but any low-privilege account is sufficient; no administrative credentials are required.

• Victim interactionNot required

  The attacker acts entirely on their own; no user needs to click a link or take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup.

Blast Radius

• Reads all data accessible to Oracle Data Integrator, including credentials, integration metadata, and any business data exposed through configured connections.
• Creates, modifies, or deletes critical data across all Oracle Data Integrator accessible datasets, including integration definitions and target-system records.
• Partially disrupts Oracle Data Integrator service availability, causing degraded performance or intermittent outages for dependent integration workflows.