The Oracle Business Intelligence Enterprise Edition includes a flaw in its Analytics Server that allows an unauthenticated attacker to send specially crafted HTTP requests. Exploitation gives the attacker read access to all data made available by the instance. The vulnerability is remote, requires no credentials, and directly compromises confidentiality, which is reflected in its CVSS base score of 7.5.

Versions 8.2.0.0.0 and 26.01.0.0.0 of Oracle Business Intelligence Enterprise Edition are affected; the weakness resides in the Analytics Server component used by these releases.

The CVSS score of 7.5 indicates a high impact on confidentiality. No EPSS score is available, and the flaw is not yet listed in the CISA KEV catalog. Because the exploit can be performed over standard HTTP traffic without authentication, any host reachable by an attacker could be compromised if the service is exposed. The simplicity of the attack and the lack of authentication requirements make it a substantial risk for organizations running the affected versions.