{"id":"CVE-2026-91668","kind":"vulnerability","aliases":["CVE-2026-91668"],"related":[],"title":"Oracle Data Integrator: low-privilege SQL attack takes over the product","description":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Data Integrator, part of Oracle Fusion Middleware, has a flaw in its Dictionary Repository component that affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low-privilege network access via SQL can take over the product, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":8.8,"epss":0.00286,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Data Integrator","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["data-integration","oracle-data-integrator","oracle-fusion-middleware","other","package","self-hosted","sql"],"not_affected_if":["managed-hosting"],"how_to_check":"Find your ODI version: 12.2.1.4.0 and 14.1.2.0.0 are affected. On the server, run opatch lsinventory from the ODI Oracle home, and check whether the October 2026 CPU Fusion Middleware patch for ODI is listed. The flaw is in the Dictionary Repository, reachable over SQL by any account that can log in. Find who has database accounts on the ODI repository schemas.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle Data Integrator (Fusion Middleware). Download it from My Oracle Support (support.oracle.com), which requires a support contract. Follow the Fusion Middleware patch availability document linked from the advisory. Oracle names no fixed version, so the exact patch number is unknown. Workaround, per Armis only: limit network access to the ODI repository database listener to trusted hosts and apply least privilege to ODI accounts. This may break ODI jobs that need broad SQL access.","status":"open","published_at":"2026-10-20T22:21:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:37+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:33:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security patch for your affected version; the patched version is not named in the sources.","reach":"network","title":"Oracle Data Integrator: low-privilege SQL attack takes over the product","impact":"high","summary":"Oracle Data Integrator, part of Oracle Fusion Middleware, has a flaw in its Dictionary Repository component that affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low-privilege network access via SQL can take over the product, with high impact to confidentiality, integrity and availability.","category":"other","who_cares":["oracle-data-integrator","oracle-fusion-middleware","data-integration"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker takes over the product and reads, changes or disrupts its data","analyst_note":"","how_to_check":"Check the installed Oracle Data Integrator version; 12.2.1.4.0 and 14.1.2.0.0 are affected. Other versions: unknown.","needs_analyst":false,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000997,"input_tokens":3085,"output_tokens":1377,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patch version covering 12.2.1.4.0 and 14.1.2.0.0 and confirm the fix and any workaround.","search":"'-2026':14A,17A '-91668':15A,18A '/av':151C '12.2.1.4.0':58B,104C '14.1.2.0.0':60B,106C '3.1':138C,150C '8.8':141C 'access':68B,116C 'affect':56B,102C 'allow':110C 'attack':8A,62B,113C,125C 'avail':83B,145C 'base':139C 'compon':54B,95C 'compromis':120C 'confidenti':80B,142C 'cve':13A,16A 'cvss':137C,147C,149C 'data':2A,20A,23B,27B,40B,88C,122C,135C 'data-integr':22B 'dictionari':52B,96C 'easili':107C 'exploit':108C 'flaw':49B 'fusion':31B,45B,93C 'h':159C 'h/a':158C 'h/i':157C 'high':77B 'host':37B 'impact':78B,146C 'integr':3A,24B,28B,41B,81B,89C,123C,136C,143C 'integrator':21A 'l/pr':153C 'l/ui':154C 'low':5A,65B,111C 'low-privileg':4A,64B 'middlewar':32B,46B,94C 'n/ac':152C 'n/s':155C 'network':67B,115C 'oracl':1A,26B,30B,39B,44B,87C,92C,121C,134C 'oracle':19A 'oracle-data-integr':25B 'oracle-fusion-middlewar':29B 'packag':34B 'part':42B 'privileg':6A,66B,112C 'product':12A,75B,90C 'repositori':53B,97C 'result':130C 'score':140C 'self':36B 'self-host':35B 'sql':7A,38B,70B,118C 'success':124C 'support':98C 'take':9A,72B 'takeov':132C 'u/c':156C 'vector':148C 'version':57B,99C 'via':69B,117C 'vulner':84C,109C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91668","severity":null,"published_at":"2026-10-20T22:21:07+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91668:531","url":null,"severity":null,"published_at":"2026-10-23T23:51:01+00:00","modified_at":"2026-10-23T23:51:01+00:00","first_seen_at":"2026-10-23T23:51:01+00:00","fetched_at":"2026-10-23T23:51:01+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists the CVE for ODI 12.2.1.4.0 and 14.1.2.0.0. Oracle publishes no fixed version number: the patch comes through My Oracle Support under the Fusion Middleware patch availability document. I could not open that document or the ODI row of the advisory (the full page was too large to search, and a direct fetch returned 403), so the Doc ID and patch number are unknown. The workaround comes only from Armis, a third party, not from Oracle. No exploitation or PoC found; I did not search X."},{"source":"epss","external_id":"CVE-2026-91668","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91668","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2198,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91668","title":"CVE Record: CVE-2026-91668","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2197,"url":"https://cve.armis.com/CVE-2026-91668","title":"CVE-2026-91668 | Armis (third-party remediation advice)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}