Oracle Data Integrator 12.2.1.4.0/14.1.2.0.0 Market Place Local Privilege Escalation

Summaryinfo

A vulnerability classified as problematic was found in Oracle Data Integrator 12.2.1.4.0/14.1.2.0.0. This impacts an unknown function of the component Market Place. Executing a manipulation can lead to Local Privilege Escalation. This vulnerability appears as CVE-2026-60723. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in Oracle Data Integrator 12.2.1.4.0/14.1.2.0.0. This vulnerability affects an unknown function of the component Market Place. The manipulation with an unknown input leads to a local privilege escalation vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

The advisory is shared for download at oracle.com. This vulnerability was named CVE-2026-60723 since 07/08/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/22/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Oracle

Name

• Data Integrator

Version

• 12.2.1.4.0
• 14.1.2.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion