SQL Injection Vulnerability in Oracle Data Integrator by Oracle
CVE-2026-91668

8.8HIGH

Key Information:

Vendor

Oracle
Status
Oracle Data Integrator
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91668?

This vulnerability exists in the Dictionary Repository component of Oracle Data Integrator, part of Oracle Fusion Middleware. An attacker with low privileges and network access can exploit this weakness using SQL queries. Successful exploitation may lead to a complete takeover of Oracle Data Integrator, compromising data confidentiality, integrity, and availability. Organizations utilizing affected versions 12.2.1.4.0 and 14.1.2.0.0 should implement security measures to mitigate potential risks.

Affected Version(s)

Oracle Data Integrator 12.2.1.4.0

Oracle Data Integrator 14.1.2.0.0

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.