This vulnerability in Oracle Data Integrator 14.1.2.0.0's Rest Service component permits an unauthenticated remote attacker to compromise the system via HTTPS without any user interaction or privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack is network-based, requires low attack complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for Oracle Data Integrator 14.1.2.0.0.

Successful exploitation allows an unauthenticated attacker with network access via HTTPS to take over Oracle Data Integrator 14.1.2.0.0. This results in full compromise of confidentiality, integrity, and availability of the affected system, potentially allowing complete control over the product and its data.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide a specific remediation level for Oracle Data Integrator 14.1.2.0.0. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information and apply any available patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Data Integrator services and monitor for any suspicious activity.