This vulnerability affects the Patchset Assistant component of Oracle Data Integrator in versions 12.2.1.4.0 and 14.1.2.0.0. It permits unauthenticated remote attackers to compromise the product via HTTP network access, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack requires no privileges or user interaction and can lead to complete confidentiality compromise without affecting integrity or availability. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly state patch availability or remediation instructions for Oracle Data Integrator. No known exploits in the wild have been reported to date.

Successful exploitation of this vulnerability allows an unauthenticated attacker to access critical or all data accessible through Oracle Data Integrator, compromising confidentiality. There is no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive information managed by Oracle Data Integrator.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until patches are confirmed and applied, restrict network access to Oracle Data Integrator HTTP interfaces to trusted sources only.