What is the CVSS score of CVE-2026-60999?

CVE-2026-60999 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Data Integrator are affected by CVE-2026-60999?

Oracle Data Integrator 14.1.2.0.0 (Fusion Middleware) contains a critical remote code execution vulnerability (CVSS 9.8) that allows unauthenticated network attackers to fully compromise the system…

How to fix or mitigate CVE-2026-60999?

Within 24 hours, inventory all systems running Oracle Data Integrator 14.1.2.0.0 and immediately restrict network access to the REST Service component-allow HTTPS traffic only from trusted administrative networks via VPN or network segmentation. Within 7 days, deploy Web Application Firewall rules to monitor and block anomalous requests to REST Service endpoints, enable full audit logging of all REST Service activity, subscribe to Oracle security advisories for patch notifications, and conduct a scope assessment of data processed by affected systems. Within 30 days, apply the vendor-released patch to all affected instances as soon as Oracle releases a fix, perform security validation of patched systems, and conduct a full forensic audit of REST Service access logs to detect any prior unauthorized activity.

Data Integrator CVE-2026-60999

EUVD-2026-47232 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qj94-r63r-g3g4

Oracle Authentication Bypass Data Integrator

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:15 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.