Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:05.287Z",
  "pubdate": "2026-08-18T21:18:05.287Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically affecting the Platform Security component in version 12.2.1.4.0. This flaw allows a low-privileged remote attacker with network access via HTTP to execute unauthorized operations against the target system.\nSuccessful exploitation of this vulnerability can lead to a complete system takeover, granting the attacker full control over the affected Oracle Business Intelligence Enterprise Edition environment. The security impact encompasses severe breaches of confidentiality, integrity, and availability, as the attacker can compromise sensitive data, manipulate system logic, and disrupt operational services.\nThe vulnerability is characterized by a high degree of exploitability, requiring low privileges and no user interaction, while being accessible remotely over the network. Given the potential for total system compromise and the broad impact across the CIA triad, this vulnerability poses significant risk implications for organizations relying on the affected platform, necessitating immediate remediation action through vendor-supplied patches and rigorous network security controls.",
  "technicalDetails": "The vulnerability resides in the Platform Security component of Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. The root cause stems from insufficient security controls and validation mechanisms within the affected component, allowing authenticated low-privileged users to interact with sensitive administrative or functional interfaces over HTTP.\nThe attack vector is network-based (AV:N), meaning the attacker does not require physical access to the target host and can initiate exploitation remotely. The attack complexity is low (AC:L), indicating that the conditions required to successfully exploit the vulnerability are minimal and do not depend on complex race conditions or unpredictable environmental factors. Furthermore, the attack requires low privileges (PR:L), signifying that any standard, authenticated user account with minimal permissions can initiate the exploit flow.\nNo user interaction (UI:N) is required, meaning the exploit can be executed programmatically and autonomously without the need for social engineering or user participation. The scope remains unchanged (S:U), implying that the vulnerability affects resources strictly bound to the security authority of the compromised component.\nThe step-by-step attack flow begins with the attacker authenticating to the Oracle Business Intelligence Enterprise Edition environment using legitimate low-privileged credentials. Leveraging network access via HTTP, the attacker crafts a malicious request targeting the vulnerable Platform Security component. Due to inadequate input validation and privilege boundary enforcement, the component processes the request improperly, failing to restrict unauthorized administrative actions.\nThis behavior allows the attacker to bypass access controls and escalate their privileges within the application. Upon successful payload execution, the attacker achieves complete administrative control, resulting in the full takeover of Oracle Business Intelligence Enterprise Edition. The post-exploitation impact includes unhindered access to underlying data stores, arbitrary code or command execution capabilities within the context of the service, and the ability to compromise the confidentiality, integrity, and availability of the entire analytics infrastructure."
}