Oracle Data Integrator: Improper privilege management in Dictionary Repository
Summary
Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Dictionary Repository component. An attacker with low-privilege access and network access can use SQL to compromise Oracle Data Integrator, with a takeover of the product as the reported impact. The attack requires valid low-privilege credentials, and no unauthenticated path is described. The NVD record is still awaiting analysis and sources differ on the weakness type (CWE-269 versus input validation).
Affected
- Oracle Data Integrator 12.2.1.4.0
- Oracle Data Integrator 14.1.2.0.0
Fixed in
Unknown. Oracle's October 2026 Critical Patch Update contains ODI fixes, but the patch identifiers and fixed versions for these releases could not be confirmed.
Workaround
Unknown. The CVE record and vendor sources provide no vendor-specific workaround.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check the ODI section of Oracle's October 2026 Critical Patch Update and My Oracle Support for the fixed patch level, then apply it.
- Restrict network access to the ODI repository database and ODI console.
- Limit the number of low-privilege ODI and repository accounts and review them regularly.
- Monitor the repository database for unusual SQL from ODI service accounts.
- Also patch CVE-2026-83396 (CVSS 9.8, unauthenticated RMI attack) from the same update and keep RMI ports off the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: Critical Patch Update October 2026 www.oracle.com
- OpenCVE: CVE-2026-91668 app.opencve.io
- Strix: CVE-2026-91668 www.strix.ai
- VulDB: CVE-2026-91668 vuldb.com
- Brandefense: Oracle October 2026 Critical Patch Update brandefense.io
- Strix: CVE-2026-83396 www.strix.ai
- Vulners: CVE-2026-91668 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:18.
Original description (NVD)
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.