EUVD-2026-46735
GHSA-9wc2-6rpj-5xf3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full read of ODI data but no integrity or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Technical ContextAI
Oracle Data Integrator (ODI) is Oracle's enterprise data-integration and ELT platform used to build and run data-movement flows across databases and Fusion Middleware. The affected surface is the Patchset Assistant component, an HTTP-reachable subsystem used during patch/upgrade operations. The CPE cpe:2.3:a:oracle_corporation:oracle_data_integrator:*:*:*:*:*:*:*:* confirms the ODI application itself is the affected product. Oracle did not assign a CWE (CWE: N/A), but the vendor tag 'Authentication Bypass' plus a confidentiality-only, unauthenticated vector points to a missing/insufficient access-control weakness (CWE-287/CWE-306 class) that exposes data without valid credentials rather than a memory-corruption or code-execution defect.
RemediationAI
Apply the fixes from the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle delivers this as CPU patches for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - the exact patch/bundle identifier should be taken from that advisory (Patch available per vendor advisory; a discrete fixed build string was not provided in the input, so cite the CPU patch, not an invented version). Until patched, reduce exposure by restricting network reachability of the ODI/Patchset Assistant HTTP endpoints to trusted management networks or via VPN, placing the console behind a reverse proxy or WAF that blocks unauthenticated access, and ensuring ODI is not internet-exposed; the trade-off is that legitimate remote administration must then traverse the allowed path, and WAF rules may need tuning to avoid breaking normal Patchset Assistant traffic. Because Oracle prohibits partial CPU application, plan to apply the full quarterly patch set rather than isolated hotfixes.
More in Oracle Data Integrator
View allComplete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthentica
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) a
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with hos
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today