CVE-2026-60318: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Data Integrator accessible data. in Oracle Corporation Oracle Data Integrator
CVE-2026-60318 is a vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 affecting the Patchset Assistant component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Data Integrator runs to gain unauthorized read access to some accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality but not integrity or availability. No official patch or remediation level is currently stated in the vendor advisory. Oracle recommends applying security patches promptly and staying on supported versions. The vendor advisory does not explicitly confirm a patch for this specific vulnerability yet, so patch status is not confirmed and should be monitored via Oracle's security alerts.
AI Analysis
Technical Summary
This vulnerability in Oracle Data Integrator's Patchset Assistant component affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and logon access to the infrastructure to compromise Oracle Data Integrator by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, and confidentiality impact only. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The vendor advisory from Oracle does not explicitly state a patch or remediation for this issue but recommends applying Critical Patch Updates regularly. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation results in unauthorized read access to some data accessible by Oracle Data Integrator, impacting confidentiality. There is no impact on integrity or availability. The attack requires local access with low privileges to the infrastructure hosting Oracle Data Integrator.
Mitigation Recommendations
Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. No specific workaround or temporary fix is provided in the advisory.
CVE-2026-60318: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Data Integrator accessible data. in Oracle Corporation Oracle Data Integrator
Description
CVE-2026-60318 is a vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 affecting the Patchset Assistant component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Data Integrator runs to gain unauthorized read access to some accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality but not integrity or availability. No official patch or remediation level is currently stated in the vendor advisory. Oracle recommends applying security patches promptly and staying on supported versions. The vendor advisory does not explicitly confirm a patch for this specific vulnerability yet, so patch status is not confirmed and should be monitored via Oracle's security alerts.
CVSS v3.1
Score 3.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Oracle Data Integrator's Patchset Assistant component affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and logon access to the infrastructure to compromise Oracle Data Integrator by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, and confidentiality impact only. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The vendor advisory from Oracle does not explicitly state a patch or remediation for this issue but recommends applying Critical Patch Updates regularly. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation results in unauthorized read access to some data accessible by Oracle Data Integrator, impacting confidentiality. There is no impact on integrity or availability. The attack requires local access with low privileges to the infrastructure hosting Oracle Data Integrator.
Mitigation Recommendations
Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. No specific workaround or temporary fix is provided in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.530Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fe6e99c2644c7f8cb1a12
Added to database: 07/21/2026, 21:38:49 UTC
Last enriched: 07/30/2026, 03:57:11 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.