Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Presentation Services component of Oracle Business Intelligence Enterprise Edition. An attacker who has any logon rights on the server can trigger a flaw that, with the aid of a separate user, compromises the entire BI instance. Successful exploitation results in takeover, affecting confidentiality, integrity and availability.

Affected Systems

Oracle Corporation’s Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 is affected. No other product variants or versions are listed in the advisory.

Risk and Exploitability

The CVSS v3.1 base score is 7.3, indicating high severity. The attack vector is local with low privilege (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). EPSS <1% shows a very low but non‑zero chance of exploitation in the wild, and the vulnerability is not in the CISA KEV catalog. Despite the low exploitation probability, a user with logon rights can trigger the flaw with another user’s cooperation, so the risk remains significant and urgent patching is warranted.

Generated by OpenCVE AI on August 19, 2026 at 20:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s official patch or upgrade to a version where this vulnerability is resolved.
  • Restrict local accounts with logon rights on servers that host Oracle BI, removing unnecessary low‑privileged access to limit local attack surface.
  • Isolate the Oracle BI infrastructure from internal network zones and enforce stringent authentication controls, including multi‑factor authentication, to reduce the probability that another user can provide the required interaction.
  • Monitor logs for unusual activity originating from local accounts and enforce audit policies to detect any attempts to exploit the Presentation Services component.

Generated by OpenCVE AI on August 19, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition
Vendors & Products Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition

Wed, 19 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Account Can Takeover Oracle Business Intelligence Enterprise Edition

Wed, 19 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Account Can Takeover Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Business Intelligence
Oracle Corporation Oracle Business Intelligence Enterprise Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:02:02.032Z

Reserved: 2026-08-04T22:06:34.616Z

Link: CVE-2026-71094

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:09.563

Modified: 2026-08-24T17:08:23.960

Link: CVE-2026-71094

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:31:59Z

Weaknesses