Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability involves an improper access control flaw (CWE-284) in the Platform Security component of Oracle Business Intelligence Enterprise Edition. An attacker who has local low‑privileged access to the infrastructure on which the product runs can exploit this weakness, leading to a full compromise of the BI environment. The flaw results in loss of confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.0.

Affected Systems

Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 is the only affected release. The vulnerability applies only to this product and version from Oracle Corporation.

Risk and Exploitability

The vulnerability is assessable locally (AV:L) and the attacker must possess low‑privileged credentials (PR:L). Exploitation can be performed without user interaction (UI:N). The CVSS score of 7.0 indicates a high risk. The EPSS score is < 1 % and the issue is not listed in the CISA KEV catalog, but the impact is severe if exploited. Attackers with sensitive system access can achieve full takeover of the BI platform.

Generated by OpenCVE AI on August 20, 2026 at 19:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Business Intelligence Enterprise Edition that addresses this issue (if available).
  • Restrict local logon privileges to a minimal set of trusted accounts and enforce least privilege on the infrastructure hosting the BI platform.
  • Continuously monitor logs for anomalous access patterns and set alerts for multiple failed logon attempts or unexpected privilege changes.

Generated by OpenCVE AI on August 20, 2026 at 19:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition
Vendors & Products Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Business Intelligence Enterprise Edition

Thu, 20 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Business Intelligence Enterprise Edition Permitting Full Platform Compromise

Wed, 19 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Business Intelligence Enterprise Edition Permitting Full Platform Compromise

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Title Low Privilege Logon Can Compromise Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Wed, 19 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Low Privilege Logon Can Compromise Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Business Intelligence
Oracle Corporation Oracle Business Intelligence Enterprise Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:01:43.684Z

Reserved: 2026-08-04T22:06:34.617Z

Link: CVE-2026-71098

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:10.030

Modified: 2026-08-24T17:09:03.367

Link: CVE-2026-71098

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:31:53Z

Weaknesses