Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:05.967Z",
  "pubdate": "2026-08-18T21:18:05.967Z",
  "executiveSummary": "An unauthenticated, network-exploitable vulnerability exists within the BI Platform Security component of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0). This remotely exploitable flaw presents a severe risk to organizational data integrity and confidentiality by allowing unauthorized threat actors to bypass authentication mechanisms entirely over the HTTP protocol. Successful exploitation of this vulnerability grants attackers unrestricted capability to compromise the affected Oracle Business Intelligence Enterprise Edition deployment, leading directly to unauthorized access to critical corporate data or complete access to all data repositories accessible via the application layer. The CVSS 3.1 base score of 7.5 reflects the high severity of the confidentiality impact, driven by the network attack vector, low attack complexity, and the complete absence of required privileges or user interaction. Consequently, organizations running the affected versions face substantial risk of data exfiltration and unauthorized information disclosure, necessitating immediate defensive measures and patch deployment as soon as vendor advisories permit.",
  "technicalDetails": "The vulnerability resides in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition, specifically affecting supported versions 8.2.0.0.0 and 26.01.0.0.0. The root cause stems from improper implementation or enforcement of access controls and authentication checks within the security subsystem handling HTTP requests. Because the flaw exhibits a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, it requires no user interaction (UI:N) and zero prior authentication (PR:N), allowing remote attackers (AV:N) with standard network connectivity to interact directly with the vulnerable endpoints over HTTP. The attack complexity is evaluated as low (AC:L), indicating that exploitation does not rely on complex race conditions, specialized ambient conditions, or advanced cryptographic bypasses. The attack flow begins when an unauthenticated threat actor crafts a malicious HTTP request targeting the exposed BI Platform Security component. Due to the failure in validating session states or authorization tokens at the application perimeter, the vulnerable component processes the request as if it originated from an authenticated, trusted entity. Upon successful payload delivery and processing, the security boundary is bypassed, granting the attacker unrestricted retrieval rights over sensitive data streams managed by the application. The post-exploitation impact is strictly localized to confidentiality, resulting in unauthorized access to critical enterprise data or complete disclosure of all underlying data stores reachable through the Oracle Business Intelligence Enterprise Edition architecture. The scope remains unchanged (S:U), as the vulnerability impacts solely the confidentiality domain of the affected software instance without directly compromising the underlying operating system kernel or adjacent host resources."
}