CVE-2026-91668 in Data Integrator
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The Oracle Data Integrator product within the Oracle Fusion Middleware suite contains a critical security flaw located in its Dictionary Repository component, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This vulnerability stems from an improper validation of user-supplied input that is processed via SQL queries. The core technical issue involves the application's failure to adequately sanitize or parameterize data before it is incorporated into dynamic SQL statements executed by the underlying database engine. This lack of robust input handling creates a classic injection vector, allowing malicious actors to manipulate the intended logic of the database operations. Because the Dictionary Repository serves as the central metadata store for Oracle Data Integrator, compromising this component effectively compromises the integrity and control plane of the entire integration environment.
The operational impact of this vulnerability is severe due to its high exploitability and broad scope. The flaw can be exploited by an attacker with low privileges who has network access to the service via SQL interfaces. This means that even users with minimal initial permissions, such as standard application users or external partners granted limited access for data integration tasks, can leverage this weakness to escalate their privileges significantly. A successful exploitation does not merely result in unauthorized read access; it enables a complete takeover of the Oracle Data Integrator instance. The attacker gains the ability to execute arbitrary commands within the context of the service account, which typically runs with elevated system permissions. This leads to a total compromise of confidentiality, integrity, and availability, as classified by the CVSS 3.1 base score of 8.8. Attackers can exfiltrate sensitive metadata, modify integration jobs to inject malicious logic into data pipelines, or disrupt services entirely through denial-of-service attacks against the middleware infrastructure.
From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector is categorized under ATT&CK technique T1059, specifically subtechnique T1059.004 for Command and Scripting Interpreter: SQL Commands, indicating that the attacker uses structured query language to interact with the backend database directly rather than through the intended application interface. Furthermore, because the vulnerability allows a low-privileged user to gain higher-level access, it also maps to CWE-269, Improper Privilege Management, highlighting the failure in enforcing least privilege principles within the application's authentication and authorization mechanisms. The network-based nature of the attack means that remote exploitation is feasible without any physical or local system interaction, increasing the risk profile for organizations with exposed middleware services.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Oracle has released patches to resolve this issue in the affected versions; therefore, the primary action required is the prompt application of these security updates to all instances running version 12.2.1.4.0 or 14.1.2.0.0. Organizations should verify their inventory of Oracle Fusion Middleware components and prioritize patching for systems that are accessible over a network. In addition to applying patches, administrators should review access controls surrounding the Dictionary Repository interface. Implementing strict role-based access control ensures that only highly trusted administrative accounts have direct SQL execution capabilities or access to sensitive metadata endpoints. Network segmentation is also critical; restricting access to Oracle Data Integrator services to known and authorized IP addresses using firewalls can significantly reduce the attack surface for low-privileged attackers attempting remote exploitation.
Long-term resilience requires a shift in development and configuration practices regarding how data is handled within integration tools. Developers and administrators should ensure that all database interactions utilize parameterized queries or prepared statements rather than string concatenation to build SQL commands, which inherently prevents injection attacks by separating code from data. Regular security assessments, including static application security testing focused on SQL generation logic and dynamic penetration testing targeting the Dictionary Repository endpoints, can help identify similar flaws before they are exploited in production environments. Monitoring logs for anomalous SQL patterns or unexpected privilege escalations will also aid in early detection of exploitation attempts. By combining timely patching with rigorous input validation standards and network hardening, organizations can effectively neutralize this threat vector and maintain the integrity of their data integration infrastructure.