CVE-2026-91668: Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. in Oracle Corporation Oracle Data Integrator

This vulnerability exists in the Dictionary Repository component of Oracle Data Integrator within Oracle Fusion Middleware. It is easily exploitable by a low privileged attacker with network access via SQL, enabling compromise of Oracle Data Integrator. Successful exploitation can lead to complete takeover of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle has included fixes for this vulnerability in their October 2026 Critical Patch Update.

An attacker with low privileges and network access can exploit this vulnerability to fully compromise Oracle Data Integrator, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and disruption of services.

Oracle has released security patches addressing this vulnerability in the October 2026 Critical Patch Update. Users of Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 should apply the official patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation.