Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:11.060Z",
  "pubdate": "2026-08-18T21:18:11.060Z",
  "executiveSummary": "A critical unauthorized data access vulnerability affects the Analytics Server component of Oracle Business Intelligence Enterprise Edition, specifically targeting versions 8.2.0.0.0 and 26.01.0.0.0. This network-exploitable flaw exposes the application to unauthenticated adversaries communicating via the HTTP protocol. The vulnerability allows remote attackers to bypass security controls entirely without requiring any prior authentication or user interaction. Successful exploitation grants the adversary unauthorized access to critical data repositories or complete, unrestricted access to all data accessible within the Oracle Business Intelligence Enterprise Edition environment. Given the high confidentiality impact, rated with a CVSS 3.1 Base Score of 7.5, the risk implication is severe, as it directly compromises organizational data integrity and privacy through easily executed remote HTTP requests.",
  "technicalDetails": "The vulnerability resides within the Analytics Server component of Oracle Business Intelligence Enterprise Edition, affecting supported software versions 8.2.0.0.0 and 26.01.0.0.0. The root cause stems from improper access control enforcement or missing authorization checks within the HTTP request handling pipeline, which fails to validate the identity and privileges of incoming clients. Network exposure is broad, as the vulnerable endpoint is accessible remotely over the network via standard HTTP protocols without requiring any pre-existing authentication tokens, sessions, or user interaction (Privileges Required: None, User Interaction: None, Attack Vector: Network, Attack Complexity: Low). The attack flow begins when an unauthenticated adversary crafts a malicious HTTP request directed at the exposed Analytics Server component. Because the application lacks adequate security boundaries at the ingestion point, the request successfully bypasses authentication and authorization layers. The vulnerable component processes the request and interacts with underlying data structures, returning sensitive information to the unauthorized requester. The payload behavior exploits the application's native data retrieval mechanisms, forcing the server to query and disclose proprietary business intelligence datasets. Post-exploitation impact is exclusively focused on confidentiality, resulting in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. The scope remains unchanged (Scope: Unchanged), but the total loss of confidentiality poses a significant risk to enterprise intelligence assets."
}