This vulnerability in Oracle Data Integrator's Patchset Assistant component affects versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise Oracle Data Integrator, potentially gaining unauthorized access to critical or all data accessible by the product. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without affecting integrity or availability. The vulnerability may also impact other Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for Oracle Data Integrator in the provided excerpt.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by Oracle Data Integrator. The confidentiality impact is high, while integrity and availability impacts are not affected. The vulnerability requires local access with low privileges and does not require user interaction. The scope change indicates that other Oracle products may also be impacted indirectly.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 in the provided data. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions.