Oracle Data Integrator CVE-2026-60625

Exploitation requires the attacker to already have a valid low-privileged account with logon access to the operating-system infrastructure where Oracle Data Integrator executes (CVSS PR:L, AV:L) - it cannot be triggered remotely or unauthenticated over a network. Affected deployments must run ODI Studio on version 12.2.1.4.0 or 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is obtained exploitation is straightforward; the primary limiting factors are the need for prior local logon and running one of the two named affected versions.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 High) describes a local, low-complexity, low-privilege attack with no user interaction and full CIA impact - high severity but gated behind local logon access, which materially limits opportunistic exploitation. No EPSS score, SSVC decision, or POC is present in the provided data, and the CVE is not listed in CISA KEV, so there is no evidence of active or automatable exploitation; realistic risk is that of a post-access privilege-escalation/takeover primitive useful to an attacker who already holds a foothold. Note a signal conflict: the vendor tag says 'Information Disclosure' while the vector and description indicate full integrity and availability compromise ('takeover'), so impact is broader than disclosure alone - treat it as escalation-to-takeover. This is a patch-in-normal-cycle priority for most environments, rising sharply for hosts where untrusted or many low-privilege users share the ODI server.

An attacker who already holds a low-privileged local account on the server where Oracle Data Integrator runs - for example a limited developer or a compromised service account - leverages the flaw in ODI Studio to escalate from that limited context to full control of the ODI product, reading integration credentials and tampering with or disabling data pipelines. No user interaction is required and attack complexity is low, but the attacker must first have local logon access; no public exploit code is identified at time of analysis.