CVE-2026-47056
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Vulnerability in Oracle Data Integrator (Rest Service component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack impacts additional products (scope change).
Risk Assessment
The risk is critical (CVSS 10.0) – an attacker can take over Oracle Data Integrator, leading to a complete breach of confidentiality, integrity, and availability.
Recommendation
Immediately apply the Oracle patch for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict access to the REST interface to trusted networks only.
Other vulnerabilities in Oracle Data Integrator
See all- CVE-2015-2636High
An unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium.
- CVE-2026-83232Critical
Vulnerability in the Oracle Data Integrator product (component: Console / Repository Explorer) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability to take over the system.
- CVE-2026-60999Critical
Vulnerability in Oracle Data Integrator (Rest Service component) allows unauthenticated attacker via HTTPS to take over the system. CVSS 9.8.
- CVE-2026-60723High
Oracle Data Integrator (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 has an easily exploitable vulnerability by a low-privileged attacker with local access. The attack may impact other products (scope change) and result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data.
- CVE-2026-60625High
Vulnerability in Oracle Data Integrator (component: Studio) allows a low-privileged attacker with local access to take over the system. Requires logon to the infrastructure where Oracle Data Integrator runs.
- CVE-2026-60320High
Vulnerability in Oracle Data Integrator (Patchset Assistant component) allows an unauthenticated attacker via HTTP to gain unauthorized access to all data.
- CVE-2026-60319Medium
Vulnerability in Oracle Data Integrator (component: Patchset Assistant) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with local access can gain unauthorized access to critical data or all Oracle Data Integrator accessible data. Attacks may impact additional products (scope change).
- CVE-2026-60318Low
A vulnerability in Oracle Data Integrator (component: Patchset Assistant) versions 12.2.1.4.0 and 14.1.2.0.0. A low privileged attacker with local access can gain unauthorized read access to a subset of data. CVSS 3.1 Base Score 3.3 (Confidentiality).
Original NVD description (English source)
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).