CVE-2026-60723: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
AI Analysis
Technical Summary
CVE-2026-60723 is a vulnerability in the Market Place component of Oracle Data Integrator within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and logon access to the underlying infrastructure to compromise Oracle Data Integrator. This compromise can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Data Integrator. The vulnerability has a CVSS 3.1 score of 8.4 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without affecting availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it.
Potential Impact
An attacker with low privileges and logon access to the infrastructure hosting Oracle Data Integrator can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data accessible by Oracle Data Integrator. This results in a significant confidentiality and integrity breach. The vulnerability's scope change means that additional Oracle products integrated or dependent on Oracle Data Integrator may also be impacted. There is no reported impact on system availability.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict infrastructure access to trusted users only, and monitor for any suspicious activity related to Oracle Data Integrator. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-60723: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as
Description
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS v3.1
Score 8.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-60723 is a vulnerability in the Market Place component of Oracle Data Integrator within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and logon access to the underlying infrastructure to compromise Oracle Data Integrator. This compromise can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Data Integrator. The vulnerability has a CVSS 3.1 score of 8.4 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without affecting availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it.
Potential Impact
An attacker with low privileges and logon access to the infrastructure hosting Oracle Data Integrator can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data accessible by Oracle Data Integrator. This results in a significant confidentiality and integrity breach. The vulnerability's scope change means that additional Oracle products integrated or dependent on Oracle Data Integrator may also be impacted. There is no reported impact on system availability.
Mitigation Recommendations
Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict infrastructure access to trusted users only, and monitor for any suspicious activity related to Oracle Data Integrator. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.583Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee0a9c2644c7f8d5b84e
Added to database: 07/21/2026, 22:09:14 UTC
Last enriched: 07/30/2026, 03:04:06 UTC
Last updated: 09/03/2026, 10:52:10 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.