How do I check whether I am affected by CVE-2026-91668?

Find your ODI version: 12.2.1.4.0 and 14.1.2.0.0 are affected. On the server, run opatch lsinventory from the ODI Oracle home, and check whether the October 2026 CPU Fusion Middleware patch for ODI is listed. The flaw is in the Dictionary Repository, reachable over SQL by any account that can log in. Find who has database accounts on the ODI repository schemas.

What is the fix for CVE-2026-91668?

Apply the Oracle October 2026 Critical Patch Update for Oracle Data Integrator (Fusion Middleware). Download it from My Oracle Support (support.oracle.com), which requires a support contract. Follow the Fusion Middleware patch availability document linked from the advisory. Oracle names no fixed version, so the exact patch number is unknown. Workaround, per Armis only: limit network access to the ODI repository database listener to trusted hosts and apply least privilege to ODI accounts. This may break ODI jobs that need broad SQL access.

Who is not affected by CVE-2026-91668?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2026-91668

Go to dashboard

high8.8Other

Oracle Data Integrator: low-privilege SQL attack takes over the product

Oracle Data Integrator, part of Oracle Fusion Middleware, has a flaw in its Dictionary Repository component that affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low-privilege network access via SQL can take over the product, with high impact to confidentiality, integrity and availability.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the product and reads, changes or disrupts its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91668

Go to dashboard

high8.8Other

Oracle Data Integrator: low-privilege SQL attack takes over the product

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over the product and reads, changes or disrupts its data.
CVSS said: 8.8. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle Data Integrator: low-privilege SQL attack takes over the product

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Data Integrator: low-privilege SQL attack takes over the product

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources