Description
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Complete compromise of Oracle Data Integrator
Action: Immediate Patch
AI Analysis

Impact

Oracle Corporation's Oracle Data Integrator relies on a Dictionary Repository component that contains a flaw classified as CWE-269 (Authorization Bypass Through User-Controlled Key). A low‑privileged attacker with network access can exploit this flaw to execute arbitrary SQL commands. Successful exploitation can lead to full takeover of the destination system, compromising confidentiality, integrity, and availability as the CVSS vector indicates high impact on all three core security objectives.

Affected Systems

Oracle Corporation's Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 are confirmed vulnerable. No other versions are listed as affected.

Risk and Exploitability

The vulnerability has a CVSS v3.1 Base Score of 8.8. The EPSS score of < 1% indicates a low exploitation probability, and it is not currently listed in CISA’s KEV catalog. The attack requires only network connectivity and an attacker with low privilege credentials, making the scenario highly realistic for threat actors with limited access. Exploitation would involve issuing crafted SQL through the exposed interface, leading to full system compromise without additional user interaction.

Generated by OpenCVE AI on October 28, 2026 at 03:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Data Integrator patch released in the October 2026 security update.
  • Restrict database user privileges for the Oracle Data Integrator service account to the minimum required permissions and remove any unused accounts.
  • Limit network exposure of the Oracle Data Integrator instance by placing it behind a firewall or network segmentation to block unauthorized remote connections.

Generated by OpenCVE AI on October 28, 2026 at 03:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Arbitrary SQL Injection in Oracle Data Integrator Dictionary Repository Allows System Compromise
Weaknesses CWE-89

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Wed, 21 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Arbitrary SQL Injection in Oracle Data Integrator Dictionary Repository Allows System Compromise
Weaknesses CWE-89

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle data Integrator
CPEs cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:data_integrator:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle data Integrator
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Data Integrator
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T21:30:25.959Z

Reserved: 2026-09-14T22:10:16.651Z

Link: CVE-2026-91668

cve-icon Vulnrichment

Updated: 2026-10-27T21:30:20.302Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:21:07.073

Modified: 2026-11-03T21:00:50.183

Link: CVE-2026-91668

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T03:45:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management