CVE-2026-91668 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Data Integrator systems, particularly those with network access via SQL, should assess exposure and prioritize patching. This includes IT administrators, security teams, and operators managing Oracle Data Integrator deployments. They should review official advisories, assess affected scope, and implement compensating controls where necessary. Vulnerability management and security teams should track this issue and ensure rem

Why it matters

CVE-2026-91668 is a high-severity vulnerability in Oracle Data Integrator that allows low-privileged attackers with network access via SQL to compromise the product. Defenders responsible for Oracle Data Integrator systems should assess exposure and prioritize patching to prevent potential takeover and data breaches.

• Potential takeover of Oracle Data Integrator systems by low-privileged attackers
• Compromise of confidentiality, integrity, and availability

Technical summary

The vulnerability in Oracle Data Integrator (component: Dictionary Repository) allows low-privileged attackers with network access via SQL to compromise the product. Successful attacks can result in takeover of Oracle Data Integrator. The CVSS 3.1 Base Score is 8.8 (Confidentiality, Integrity and Availability impacts). The vulnerability is easily exploitable and affects versions 12.2.1.4.0 and 14.1.2.0.0. Defenders should focus on patching and restricting access to prevent exploitation. The CVE record and NVD entry provide additional technical details.

Defensive priority

High

Recommended defensive actions

• Review and apply Oracle's security patches for Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict network access to Oracle Data Integrator to only necessary personnel.
• Monitor Oracle Data Integrator systems for suspicious SQL activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Data Integrator. Oracle's security alert (CPUOct2026) addresses this issue. The vulnerability is in the Dictionary Repository component of Oracle Data Integrator. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Defenders should verify affected product deployments and review official advisories for scope, severity, and guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.