EUVD-2026-46733
GHSA-332v-hxpf-4m4c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local-only attack requiring low OS privileges to reach Patchset Assistant; impact is limited to partial confidentiality loss with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
Technical ContextAI
Oracle Data Integrator (ODI) is an enterprise-grade ETL/ELT platform within the Oracle Fusion Middleware stack, widely used for data integration pipelines in large Oracle-centric environments. The vulnerable component is the Patchset Assistant, a utility responsible for applying patch sets to ODI installations. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_data_integrator applies to both affected versions. No CWE was formally assigned, but the 'Authentication Bypass' tag in source intelligence suggests the root cause involves insufficient access control enforcement within the Patchset Assistant execution context - potentially allowing a local low-privileged process or user to read ODI configuration or operational data that should be restricted to higher-privileged roles. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is consistent with a local privilege boundary weakness rather than a network-facing flaw.
RemediationAI
Apply the patches issued by Oracle in the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory covers both affected versions (12.2.1.4.0 and 14.1.2.0.0); exact patched build numbers should be obtained directly from My Oracle Support. As a compensating control prior to patching, restrict local OS-level logon access to ODI infrastructure hosts to only operationally necessary, trusted accounts - this directly eliminates the PR:L attack path since exploitation requires local session access. Additionally, audit existing user accounts on ODI hosts to identify and remove or restrict unnecessary low-privileged accounts. Limiting execution permissions on the Patchset Assistant binary to administrative roles only can further constrain exposure, though this may affect routine patch operations and should be tested before enforcement.
More in Oracle Data Integrator
View allComplete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthentica
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) a
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with hos
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today