CVE-2026-60318

LOW

Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 - Authenticated Information Disclosure via Patchset Assistant

Title source: llm
STIX 2.1

Description

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
Oracle Advisory
https://www.oracle.com/security-alerts/cpujul2026.html

Scores

CVSS v3 3.3
EPSS 0.0014
EPSS Percentile 3.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (4)
oracle/data_integrator 12.2.1.4.0
oracle/data_integrator 14.1.2.0.0
Oracle Corporation/Oracle Data Integrator 12.2.1.4.0
Oracle Corporation/Oracle Data Integrator 14.1.2.0.0
Published Jul 21, 2026
Tracked Since Jul 22, 2026