What is the CVSS score of CVE-2026-60723?

CVE-2026-60723 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Data Integrator are affected by CVE-2026-60723?

Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 contain a privilege-escalation vulnerability (CVE-2026-60723, CVSS 8.4) that allows authenticated local users to escalate privileges and…

How to fix or mitigate CVE-2026-60723?

Within 24 hours, identify all Oracle Data Integrator instances running versions 12.2.1.4.0 or 14.1.2.0.0 and enumerate local user accounts with host access. Within 7 days, restrict local login access to ODI servers to essential administrative personnel only, implement host-based access logging and alerting for local interactive sessions, and apply OS-level security controls (PAM, sudo restrictions, etc.). Within 30 days, establish patch testing and deployment procedures for when the vendor releases a fix, and assess all systems downstream of ODI for data integrity and unauthorized access anomalies.

Oracle Data Integrator CVE-2026-60723

EUVD-2026-47067 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jmc8-p7mj-27m6

Authentication Bypass Oracle Data Integrator

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Requires local logon with a low-privilege account (AV:L, PR:L), low complexity and no interaction; authorization bypass fully compromises confidentiality and integrity but not availability, with a scope change (S:C).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.

Technical ContextAI

Oracle Data Integrator (ODI) is Oracle Fusion Middleware's enterprise ETL/data-integration platform used to build and orchestrate bulk data movement and transformation across databases and applications. The affected 'Market Place' component and the vendor tag 'Authentication Bypass' suggest an access-control or trust-boundary weakness that lets an already-authenticated low-privilege principal exceed its authorization. No CWE was assigned (CWE: N/A), so the precise root-cause class is not formally categorized, but the impact profile (confidentiality and integrity fully compromised, availability untouched) combined with the scope change (S:C) indicates the vulnerable ODI component can act on resources managed by a separate security authority - consistent with an authorization/trust boundary failure rather than memory corruption.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering this issue; Patch available per vendor advisory, though the input does not specify an exact fixed build number, so consult the CPU matrix for the correct patch for your 12.2.1.4.0 or 14.1.2.0.0 installation. Until patching is complete, reduce exposure by tightly restricting who can log on to or hold local accounts on the ODI host (this flaw needs local logon and low privileges), removing unnecessary low-privilege ODI/OS accounts, and enforcing least privilege on the Market Place component and ODI repository access; note the trade-off that constraining local accounts may disrupt legitimate developers or scheduled agents that run on the same host. Monitor ODI repository and audit logs for unexpected data creation, deletion, or modification as a compensating detection while the patch is staged.