Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:18:10.150Z",
  "pubdate": "2026-08-18T21:18:10.150Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically impacting the Analytics Web Answers component in version 26.01.0.0.0. This easily exploitable flaw allows a malicious actor with network access via the HTTP protocol to execute a comprehensive system compromise.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.2, with high impacts across Confidentiality, Integrity, and Availability (C/I/A:H/H/H). Successful exploitation of this vulnerability directly results in the complete takeover of the affected Oracle Business Intelligence Enterprise Edition instance. The attack vector is network-based, requiring low attack complexity but necessitating high privileges and no user interaction.\nGiven the severity of potential impacts—ranging from complete data exposure to total service disruption and administrative dominion over the business intelligence infrastructure—organizations utilizing the specified version face substantial risk. Remediation requires immediate attention to administrative access controls and the application of official vendor patches as soon as they become available.",
  "technicalDetails": "The vulnerability resides in the Analytics Web Answers component of Oracle Business Intelligence Enterprise Edition, specifically within version 26.01.0.0.0. The flaw manifests as an authorization and validation deficiency within the web-based administrative interfaces accessible over HTTP, allowing high-privileged users to leverage administrative functionalities in unintended ways that compromise the underlying system architecture.\nExploitation requires the attacker to possess authenticated high privileges within the application environment. Although the attacker must be authenticated with elevated administrative roles, the attack complexity is classified as low, and the vector is entirely network-based (AV:N/AC:L/PR:H/UI:N). No user interaction is required (UI:N), meaning an automated or direct HTTP request can initiate the attack sequence once the prerequisite privileges are established or compromised.\nThe attack flow proceeds via crafted HTTP requests directed at the vulnerable Analytics Web Answers endpoints. Because the component fails to properly restrict or sanitize administrative inputs and operational commands, a malicious high-privileged user can manipulate the application logic to execute unauthorized system-level operations or override core security controls.\nUpon successful execution of the exploit payload, the attacker achieves total control over the Oracle Business Intelligence Enterprise Edition instance. The post-exploitation impact encompasses complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), granting the adversary the ability to exfiltrate sensitive business intelligence data, alter reports and underlying metadata structures, and disrupt operational analytics services entirely."
}