Oracle Data Integrator CVE-2026-91668

Exploitation requires a low-privilege authenticated account on the target Oracle Data Integrator instance (CVSS PR:L) with network reachability to the service, and the attack is delivered via SQL against the Dictionary Repository component. Affected deployments are limited to ODI versions 12.2.1.4.0 and 14.1.2.0.0. The authentication prerequisite is the primary limiting factor - this is not remote-unauthenticated - but no user interaction, no special non-default configuration, and only low attack complexity are needed, so any valid low-privilege ODI credential plus network access is sufficient.

This is a genuinely high-priority flaw by CVSS signals: the vendor-provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact resulting in complete takeover of Oracle Data Integrator. However, several real-world-risk signals are MISSING and should temper prioritization: no EPSS score was provided, so exploitation probability cannot be quantified; KEV status is not present (no CISA listing), so there is no confirmed active exploitation; and no POC/exploit code is referenced, so weaponization is unproven. No SSVC decision data (automatable, exploitation status) was supplied. The only source is Oracle's October 2026 Critical Patch Update advisory. Net assessment: patch promptly because the technical severity and low barrier (authenticated-but-low-privilege, network SQL path) are serious, but current evidence points to a theoretical/not-yet-exploited issue rather than a confirmed in-the-wild campaign - treat as high-severity-pending-exploitation, not an emergency on par with a KEV-listed bug. Note also that the 'Information Disclosure' tag understates impact, since the CVSS vector and description indicate full takeover, not just disclosure - verify scope against Oracle's advisory.

An attacker who already holds a low-privilege authenticated account on an Oracle Data Integrator instance sends crafted SQL to the Dictionary Repository component over the network, abusing it to escalate to full compromise and take over the ODI environment. Because attack complexity is low and no user interaction is required, exploitation is straightforward once network and credential prerequisites are met. No public exploit identified at time of analysis, so this scenario is derived from the CVSS vector and description rather than observed attacks.