---
id: "CVE-2026-91668"
kind: "vulnerability"
aliases: ["CVE-2026-91668"]
title: "Oracle Data Integrator: low-privilege SQL attack takes over the product"
severity: "high"
cvss: 8.8
epss: 0.00286
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Data Integrator", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["data-integration", "oracle-data-integrator", "oracle-fusion-middleware", "other", "package", "self-hosted", "sql"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:21:07+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91668", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:51:01+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91668", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Oracle Data Integrator: low-privilege SQL attack takes over the product

Oracle Data Integrator, part of Oracle Fusion Middleware, has a flaw in its Dictionary Repository component that affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low-privilege network access via SQL can take over the product, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Data Integrator affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Find your ODI version: 12.2.1.4.0 and 14.1.2.0.0 are affected. On the server, run opatch lsinventory from the ODI Oracle home, and check whether the October 2026 CPU Fusion Middleware patch for ODI is listed. The flaw is in the Dictionary Repository, reachable over SQL by any account that can log in. Find who has database accounts on the ODI repository schemas.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Oracle Data Integrator (Fusion Middleware). Download it from My Oracle Support (support.oracle.com), which requires a support contract. Follow the Fusion Middleware patch availability document linked from the advisory. Oracle names no fixed version, so the exact patch number is unknown. Workaround, per Armis only: limit network access to the ODI repository database listener to trusted hosts and apply least privilege to ODI accounts. This may break ODI jobs that need broad SQL access.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91668
- 2026-10-23T23:51:01+00:00 analyst — Oracle October 2026 CPU (cpuoct2026) lists the CVE for ODI 12.2.1.4.0 and 14.1.2.0.0. Oracle publishes no fixed version number: the patch comes through My Oracle Support under the Fusion Middleware patch availability document. I could not open that document or the ODI row of the advisory (the full page was too large to search, and a direct fetch returned 403), so the Doc ID and patch number are unknown. The workaround comes only from Armis, a third party, not from Oracle. No exploitation or PoC found; I did not search X.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91668

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91668 https://www.cve.org/CVERecord?id=CVE-2026-91668
- [mitigation] CVE-2026-91668 | Armis (third-party remediation advice) https://cve.armis.com/CVE-2026-91668

## From the sources

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_