This vulnerability in Oracle Data Integrator (component: Patchset Assistant) permits an unauthenticated remote attacker to compromise the product via HTTP network access. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through Oracle Data Integrator. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory from Oracle does not explicitly state patch availability or remediation details for this specific vulnerability within the provided content but references the July 2026 Critical Patch Update advisory.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to sensitive or all data managed by Oracle Data Integrator. This compromises confidentiality but does not affect integrity or availability. The impact is significant due to the potential exposure of critical data without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is applied, restrict network access to Oracle Data Integrator interfaces to trusted users only and monitor for unusual access patterns.