This vulnerability affects Oracle Data Integrator components in versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw allowing a low privileged attacker with network access via HTTP to gain unauthorized capabilities including creation, deletion, or modification of critical data, full access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 others. The vendor strongly urges customers to apply these patches immediately to mitigate risk. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may disrupt normal operations.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Data Integrator. Attackers can gain unauthorized access to all data accessible by the product and cause partial denial of service conditions. The vulnerability impacts confidentiality, integrity, and availability with high severity as reflected by the CVSS score of 8.3.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality and should be tested accordingly. Patch status is not explicitly confirmed in the advisory text but is implied available via the Critical Security Patch Update. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.