CVE-2026-60999: oracle corporation oracle data integrator Improper Access Control

Vulnerability summary

CVE-2026-60999 is a critical (CVSS 9.8) Improper Access Control vulnerability in oracle corporation oracle data integrator. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 24-07-2026
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.