The Oracle Business Intelligence Enterprise Edition contains a flaw in its Analytics Server component that permits an attacker without authentication to send crafted HTTP requests, resulting in the ability to read all data exposed by the instance. The weakness is Information Exposure (CWE-200). This unauthorized data access directly violates confidentiality and is reflected in the CVSS base score of 7.5. Because the flaw is remote, requires no credentials, and has low attack complexity, it can be exploited by any attacker who can reach the service over HTTP.

Versions 8.2.0.0.0 and 26.01.0.0.0 of Oracle Business Intelligence Enterprise Edition are affected; the weakness resides in the Analytics Server component used by these releases.

The CVSS score of 7.5 indicates a high confidentiality impact. The EPSS score of <1% signals a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the exploit can be carried out over standard HTTP traffic without authentication, any host reachable by an attacker could be compromised if the service is exposed. The simplicity of the attack and the lack of authentication requirements make it a substantial risk for organizations running the affected versions.