This vulnerability affects Oracle Data Integrator component Studio in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Data Integrator. The CVSS 3.1 base score is 7.8, indicating high severity, with impacts on confidentiality, integrity, and availability. The vulnerability is classified under CWE-269 (Improper Privilege Management). No specific patch or remediation level is stated in the vendor advisory, but the vulnerability is included in Oracle's July 2026 Critical Patch Update advisory. The advisory recommends applying security patches promptly. There are no known exploits in the wild at this time.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to fully compromise Oracle Data Integrator. This results in complete loss of confidentiality, integrity, and availability of the affected product, potentially allowing takeover of Oracle Data Integrator.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to apply the relevant security patches from this update without delay. No alternative mitigations or temporary fixes are provided. Patch status is not explicitly confirmed in the advisory text; therefore, check Oracle's official Critical Patch Update documentation for the latest patch availability and installation instructions.