CVE-2026-60320

Analyzed Analyzed - Analysis Complete

Unauthenticated Access in Oracle Data Integrator

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Oracle

Description

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60320

EUVD

EUVD-2026-46735

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	data_integrator	12.2.1.4.0
oracle	data_integrator	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all Oracle Data Integrator accessible data.

Detection Guidance

This vulnerability affects Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. Detection involves checking for exposed instances of Oracle Data Integrator via HTTP. Use network scanning tools like nmap to identify open ports (typically 80, 443, or custom ports) on systems running Oracle Data Integrator. Example command: nmap -p 80,443 <target_IP>. Verify if the Patchset Assistant component is accessible without authentication.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive data stored or processed by Oracle Data Integrator. This may include confidential business information, personal data, or other critical assets, potentially leading to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Organizations may face legal penalties, reputational damage, or loss of certification if data breaches occur due to this vulnerability.

Mitigation Strategies

Apply the latest Oracle Data Integrator patchset immediately to address the vulnerability in the Patchset Assistant component.

Hi! I’m here to help you understand CVE-2026-60320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70