Oracle Data Integrator CVE-2026-60320

Exploitation requires network HTTP access to an Oracle Data Integrator instance (versions 12.2.1.4.0 or 14.1.2.0.0) with the Patchset Assistant component reachable; per the CVSS vector no authentication, no privileges, and no user interaction are needed (PR:N/UI:N/AC:L). The primary limiting factor is network reachability: only ODI deployments whose HTTP endpoints are exposed to the attacker (internet-facing or reachable from a compromised internal foothold) are at risk, and only the two named supported versions are confirmed affected. Impact is bounded to unauthorized data reads (C:H, I:N, A:N) - the flaw does not itself permit modification or service disruption.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes an easily exploitable, network-reachable, unauthenticated read-only exposure - high confidentiality impact but no integrity or availability effect, so this is a data-disclosure issue, not a takeover. Corroborating signals are limited: no EPSS score, no CISA KEV listing, and no POC were provided, so real-world exploitation pressure cannot be quantified from the input. The 7.5 rating and PR:N make it a credible patch priority for internet- or intranet-exposed ODI instances, but the absence of KEV/EPSS/POC data means there is currently no evidence of active or imminent mass exploitation. Note a mild tension to verify: the vendor tag says 'Authentication Bypass' (implying access to protected functionality) yet the scored impact is confidentiality-only (C:H, I:N, A:N) - treat the tag as thematic, and rely on the vector for scope.

An attacker who can reach an ODI instance's HTTP interface sends crafted unauthenticated requests to the Patchset Assistant component and retrieves data that should require authentication, exfiltrating sensitive integration metadata or business data accessible to ODI. Because no privileges or user interaction are required (PR:N/UI:N/AC:L), the request can be automated and repeated at scale. No public POC was identified in the provided data, so this scenario is derived from the CVSS vector rather than a demonstrated exploit.