CVE-2026-60319 Overview
CVE-2026-60319 affects the Patchset Assistant component of Oracle Data Integrator, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with local logon access to the infrastructure hosting Oracle Data Integrator to compromise the product. Successful exploitation results in unauthorized access to critical data or complete read access to all data accessible through Oracle Data Integrator. The vulnerability carries a scope change, meaning the impact extends beyond the vulnerable component to additional Oracle products. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Local, low-privileged attackers can gain complete confidentiality-impact access to Oracle Data Integrator data, with scope change extending exposure to adjacent Oracle Fusion Middleware components.
Affected Products
- Oracle Data Integrator 12.2.1.4.0
- Oracle Data Integrator 14.1.2.0.0
- Oracle Fusion Middleware (Patchset Assistant component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60319 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60319
Vulnerability Analysis
The vulnerability resides in the Patchset Assistant component of Oracle Data Integrator. Patchset Assistant is the utility Oracle Fusion Middleware administrators run to update schemas during patching operations. An attacker who can authenticate to the host operating system with low privileges can abuse the component to reach data that should be restricted. Because the CVSS scope is marked as changed, the attack impacts security-relevant resources managed outside the vulnerable component itself. The flaw affects confidentiality only, with no integrity or availability impact reported by Oracle. According to Oracle's advisory, exploitation is easy and requires no user interaction.
Root Cause
Oracle has not published the underlying weakness class or [CWE] mapping for CVE-2026-60319. The Oracle Security Alert July 2026 describes the issue as an information disclosure path in Patchset Assistant that fails to properly enforce access boundaries when invoked by a local, authenticated user. Because Patchset Assistant handles schema metadata and database connection material during patch operations, improper access control in this component can expose sensitive configuration and repository data.
Attack Vector
The attack vector is local. The attacker requires an authenticated shell or interactive session on the server where Oracle Data Integrator runs. No user interaction from another account is needed. After logon, the attacker interacts with Patchset Assistant to read data that the caller should not be able to access, including data belonging to other Fusion Middleware components due to the scope change. The vulnerability is not remotely exploitable, and Oracle reports no public proof-of-concept or in-the-wild exploitation. The EPSS probability is 0.135%.
No verified exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor technical details.
Detection Methods for CVE-2026-60319
Indicators of Compromise
- Unexpected execution of psa.sh or psa.cmd (Patchset Assistant binaries) by non-administrative local accounts.
- Access to Oracle Data Integrator repository schemas or WLS_ODI logs from user contexts that do not normally run patching operations.
- Reads of Fusion Middleware config.xml, credential wallets, or JDBC datasource files by low-privileged local users.
Detection Strategies
- Enable operating system auditing on the Oracle Data Integrator middleware home and log all invocations of Patchset Assistant binaries.
- Correlate local logon events with subsequent process execution under the Oracle Data Integrator installation directory.
- Monitor Oracle database audit logs for repository schema queries originating from unexpected client hosts or OS users.
Monitoring Recommendations
- Alert on any Patchset Assistant execution outside of scheduled maintenance windows.
- Track file access to Fusion Middleware credential stores and repository configuration files.
- Review privileged group membership on Oracle Data Integrator hosts weekly to reduce the pool of accounts that satisfy the local logon precondition.
How to Mitigate CVE-2026-60319
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 deployments.
- Restrict interactive and remote shell logon on Oracle Data Integrator servers to a minimal set of administrators.
- Rotate credentials stored in Fusion Middleware wallets and repository schemas after patching, in case they were exposed.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should download and apply the Oracle Data Integrator patches referenced in the Oracle Security Alert July 2026 and run Patchset Assistant to update repository schemas per Oracle's post-patch instructions.
Workarounds
- Remove execute permissions on Patchset Assistant binaries for all non-administrative local users until the patch is applied.
- Enforce least privilege on the middleware host so only authorized operators hold local logon rights.
- Segment Oracle Data Integrator servers on a management network to limit which accounts can establish local sessions.
# Restrict Patchset Assistant execution to the Oracle software owner
chown oracle:oinstall $ORACLE_HOME/oracle_common/upgrade/bin/psa
chmod 700 $ORACLE_HOME/oracle_common/upgrade/bin/psa
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
