CVE-2026-91668
HighCVSS 8.8Summary
A vulnerability in Oracle Data Integrator (Dictionary Repository component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via SQL to take over the product.
Risk Assessment
Could result in full takeover of Oracle Data Integrator, impacting confidentiality, integrity and availability of processed data. Requires only low privileges.
Recommendation
Apply Oracle Critical Patch Update fixes for Oracle Data Integrator. Restrict account privileges and network access to the minimum necessary.
Other vulnerabilities in Oracle Data Integrator
See all- CVE-2026-83398High
Vulnerability in Oracle Data Integrator (Data Transforms component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data, modify it and gain full access to Oracle Data Integrator data.
- CVE-2015-2636High
An unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium.
- CVE-2026-83397Critical
Vulnerability in Oracle Data Integrator (component Console / Repository Explorer) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily compromise the product and take it over. CVSS 3.1 Base Score is 9.8 with confidentiality, integrity and availability impacts.
- CVE-2026-83396Critical
Vulnerability in Oracle Data Integrator (component Console / Repository Explorer) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via RMI can easily compromise the product and take it over. CVSS 3.1 Base Score is 9.8 with confidentiality, integrity and availability impacts.
- CVE-2026-83232Critical
Vulnerability in the Oracle Data Integrator product (component: Console / Repository Explorer) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability to take over the system.
- CVE-2026-60999Critical
Vulnerability in Oracle Data Integrator (Rest Service component) allows unauthenticated attacker via HTTPS to take over the system. CVSS 9.8.
- CVE-2026-47056Critical
Vulnerability in Oracle Data Integrator (Rest Service component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack impacts additional products (scope change).
- CVE-2026-60723High
Oracle Data Integrator (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 has an easily exploitable vulnerability by a low-privileged attacker with local access. The attack may impact other products (scope change) and result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data.
- CVE-2026-60625High
Vulnerability in Oracle Data Integrator (component: Studio) allows a low-privileged attacker with local access to take over the system. Requires logon to the infrastructure where Oracle Data Integrator runs.
- CVE-2026-60320High
Vulnerability in Oracle Data Integrator (Patchset Assistant component) allows an unauthenticated attacker via HTTP to gain unauthorized access to all data.
Original NVD description (English source)
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS