CVE-2026-60999: Oracle Data Integrator RCE Vulnerability

CVE-2026-60999 Overview

CVE-2026-60999 is a critical vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware, specifically within the Rest Service component. The affected version is 14.1.2.0.0. An unauthenticated attacker with network access via HTTPS can exploit this flaw to compromise Oracle Data Integrator. Successful exploitation results in full takeover of the product, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can achieve complete takeover of Oracle Data Integrator instances through the exposed REST service over HTTPS.

Affected Products

Oracle Fusion Middleware — Oracle Data Integrator
Component: Rest Service
Version: 14.1.2.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60999 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-60999

Vulnerability Analysis

The vulnerability exists in the REST service component of Oracle Data Integrator (ODI), a data integration platform used to build, deploy, and manage complex data warehouses. Oracle classifies the flaw as easily exploitable, requiring no privileges, no user interaction, and no prior authentication. An attacker only needs network reachability to the HTTPS endpoint exposed by the ODI REST service.

Successful exploitation results in complete takeover of the Oracle Data Integrator instance, granting the attacker control over integration jobs, credentials, and connected data sources. Because ODI typically holds elevated credentials for databases, ETL targets, and cloud services, compromise of the platform frequently cascades into downstream data stores.

Oracle has not published detailed technical information about the underlying defect, in line with its Critical Patch Update disclosure policy. Based on the CVSS metrics and the affected component, the flaw is consistent with an authentication or input-handling weakness in an exposed REST endpoint.

Root Cause

Oracle's advisory attributes the issue to the Rest Service component of Oracle Data Integrator 14.1.2.0.0. The vulnerability allows an unauthenticated request to reach a code path that should require authentication or additional validation, enabling attacker-controlled input to compromise the service.

Attack Vector

The attack is delivered over the network via HTTPS to the ODI REST service. No credentials, tokens, or user actions are required. Any host able to reach the ODI REST endpoint — including hosts inside a corporate network with lateral access — can attempt exploitation.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.358% as of 2026-07-23. Given the network-reachable, unauthenticated nature of the flaw, exploitation attempts are expected once technical details or PoCs surface.

Detection Methods for CVE-2026-60999

Indicators of Compromise

Unexpected HTTPS requests to Oracle Data Integrator REST endpoints from external or unusual internal source addresses.
New or modified ODI scenarios, load plans, or agent configurations that were not initiated by administrators.
Outbound connections from ODI agents to unknown hosts, or unexpected access to connected data sources using ODI-stored credentials.
Creation of new ODI users, roles, or repository entries outside of change-control windows.

Detection Strategies

Inspect web server and reverse proxy logs for anomalous request patterns, oversized payloads, or unusual verbs targeting ODI REST paths.
Correlate authentication logs for ODI with process execution and outbound network activity on the underlying host to identify post-exploitation behavior.
Alert on unauthenticated HTTPS requests that reach ODI REST endpoints and return successful (2xx) responses to sensitive operations.

Monitoring Recommendations

Enable verbose logging on the ODI REST service and forward logs to a centralized SIEM for retention and correlation.
Monitor the ODI host for unexpected child processes spawned by Java or WebLogic runtime processes.
Track configuration drift on ODI repositories and agents using file integrity monitoring.

How to Mitigate CVE-2026-60999

Immediate Actions Required

Apply the fixes contained in the Oracle July 2026 Critical Patch Update to all Oracle Data Integrator 14.1.2.0.0 deployments.
Inventory all internal and internet-facing ODI instances and confirm patch status before returning them to production.
Rotate credentials stored in ODI repositories and agents if compromise cannot be ruled out.
Review ODI audit logs and repository changes for unauthorized activity since the affected version was deployed.

Patch Information

Oracle released the corrective patch as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's guidance for applying Fusion Middleware bundle patches to Oracle Data Integrator 14.1.2.0.0. Refer to the Oracle Critical Patch Update advisory for patch identifiers and installation instructions.

Workarounds

Restrict network access to the ODI REST service using firewall rules or a reverse proxy that permits only trusted management networks.
Place ODI behind an authenticating gateway or web application firewall that enforces mutual TLS or additional access controls.
Disable the ODI REST service on instances where it is not required until the patch is applied.
Segment ODI hosts from general user networks and from the internet to limit blast radius.

bash

# Example: restrict access to the ODI REST endpoint to a management subnet using iptables
iptables -A INPUT -p tcp --dport 15101 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15101 -j DROP