What is the CVSS score of CVE-2026-60319?

CVE-2026-60319 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle Data Integrator CVE-2026-60319

EUVD-2026-46734 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-mp3q-f8jf-7268

Authentication Bypass Oracle Oracle Data Integrator Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local-only vector with low OS privileges aligns with the description; scope change reflects ODI connectivity to external systems; no integrity or availability impact is stated.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.

Technical ContextAI

Oracle Data Integrator (ODI) is an enterprise ETL and data integration platform within the Oracle Fusion Middleware stack, used to design, deploy, and orchestrate complex data movement and transformation workflows across heterogeneous data sources. The affected component - Patchset Assistant - handles incremental patch application and schema migration operations against the ODI repository and runtime environment, typically requiring elevated internal permissions to function. The CPE string (cpe:2.3:a:oracle_corporation:oracle_data_integrator) confirms both versions 12.2.1.4.0 and 14.1.2.0.0 are affected. No CWE is assigned by the reporter, but the 'Authentication Bypass' tag combined with the CVSS PR:L and S:C metrics suggests the Patchset Assistant component fails to enforce ODI's internal authorization model adequately, allowing a low-privileged OS-level user to escalate their effective access within ODI. Because ODI maintains repository credentials and connections to upstream and downstream data stores, the exploitable data surface extends well beyond ODI's own repository.

RemediationAI

Organizations should apply the relevant patches from Oracle's July 2026 Critical Patch Update immediately by consulting the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and downloading the corresponding patch bundles from My Oracle Support (MOS). Exact patch build numbers are not cited in the public advisory reference and must be retrieved from MOS for each affected version (12.2.1.4.0 and 14.1.2.0.0). As a compensating control pending patching, enforce strict least-privilege access on the host OS running ODI: remove unnecessary low-privileged user accounts from interactive logon groups on the ODI server and restrict shell access to trusted administrative accounts only. Additionally, applying OS-level file and directory permission restrictions to the Patchset Assistant binaries and ODI repository configuration files can reduce the attack surface - note this may interfere with scheduled patch operations and should be validated in a non-production environment before applying to production. Monitoring local authentication logs on ODI hosts for anomalous low-privileged user activity provides a detective control until patching is complete.