Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:09.800Z",
  "pubdate": "2026-08-18T21:18:09.800Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically affecting the BI Platform Security component. The vulnerability affects supported software versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. This security flaw is categorized as difficult to exploit, requiring specific conditions, yet it grants a low-privileged threat actor with network access the ability to compromise the target application.\nDue to a change in the security scope, successful exploitation of this vulnerability extends its impact beyond the immediate Oracle Business Intelligence Enterprise Edition boundaries, potentially affecting additional integrated products. The compromise results in severe consequences for data security, granting unauthorized actors the capability to execute creation, deletion, and modification operations on critical datasets, as well as complete unauthorized read access to all accessible data within the ecosystem.\nThe severity of this issue is reflected in its CVSS 3.1 Base Score of 8.2, driven entirely by high confidentiality and integrity impacts. Organizations utilizing the specified vulnerable versions face substantial risk regarding data integrity and unauthorized information disclosure, necessitating immediate remediation planning aligned with vendor advisories.",
  "technicalDetails": "The vulnerability resides in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition across versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The root cause stems from insufficient validation and authorization enforcement within the security subsystem, allowing low-privileged authenticated users to interact with sensitive administrative or data-handling functions that exceed their intended role boundaries.\nThe attack vector is network-based via HTTP (AV:N), meaning an adversary does not require physical access to the host system. The attack complexity is rated as high (AC:H), indicating that successful exploitation requires specific preconditions, precise timing, or configuration dependencies. Authentication is required at a low privilege level (PR:L), signifying that the attacker must possess valid user credentials within the application. User interaction is not required (UI:N), allowing for automated or direct exploitation by the malicious actor.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the vulnerable Oracle Business Intelligence Enterprise Edition instance. Second, leveraging the insufficient privilege checks within the BI Platform Security component, the attacker crafts specialized requests targeting security boundaries that should normally be restricted. Third, because the vulnerability introduces a scope change (S:C), the crafted requests bypass the primary application domain constraints, affecting downstream or supplementary integrated products.\nUpon successful exploitation, the payload behavior enables unauthorized data manipulation and extraction. The attacker achieves unauthorized creation, deletion, or modification access to critical data and all accessible records within Oracle Business Intelligence Enterprise Edition. Furthermore, the attacker gains complete unauthorized access to view critical and sensitive data, severely breaching confidentiality and integrity parameters while availability remains unaffected (A:N). The resulting vector is formally expressed as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N."
}