Oracle Data Integrator
Monthly
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) allows a low-privileged attacker with HTTP network access to read, modify, or delete all data accessible to the product and induce a partial denial of service. Oracle assigns a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and no public exploit identified at time of analysis. The flaw is described by Oracle as easily exploitable, raising the priority for any externally reachable ODI deployment.
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.
Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Authenticated tampering and data exposure in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) allows a low-privileged attacker with HTTP network access to read, modify, or delete all data accessible to the product and induce a partial denial of service. Oracle assigns a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and no public exploit identified at time of analysis. The flaw is described by Oracle as easily exploitable, raising the priority for any externally reachable ODI deployment.
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.