Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-09-15
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Platform Security component of Oracle Business Intelligence Enterprise Edition, allowing an attacker with low privileges who can reach the system over HTTP to execute arbitrary code on the server and potentially take full control. Successful exploitation results in a comprehensive compromise of confidentiality, integrity, and availability for data and services exposed by the BI platform.

Affected Systems

Affected system: Oracle Business Intelligence Enterprise Edition (Oracle Analytics) version 12.2.1.4.0. The CVE notes that the scope may impact additional Oracle products, but the primary target is the specified BI edition.

Risk and Exploitability

The base CVSS score of 9.9 indicates critical severity. An EPSS score below 1% suggests that current exploitation rates are low, yet the vulnerability remains highly actionable. It is not yet listed in CISA KEV. The likely attack vector is remote HTTP traffic with low privilege, where an attacker can send crafted requests from an external network to trigger the flaw without authentication or elevated rights.

Generated by OpenCVE AI on September 20, 2026 at 08:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Consult Oracle's security advisory and apply the vendor‑provided patch or update as soon as it becomes available.
  • Restrict external HTTP access to the BI server by configuring firewall rules or IP whitelists.
  • Enable comprehensive logging and real‑time monitoring on the BI platform to detect anomalous HTTP requests or unauthorized privilege escalation attempts.
  • Verify that the server’s authentication and authorization mechanisms enforce least privilege and correct any over‑privileged configurations.

Generated by OpenCVE AI on September 20, 2026 at 08:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition
Vendors & Products Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition

Sun, 20 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Allows Takeover of Oracle BI EE 12.2.1.4.0

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Low-Privilege HTTP in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Low-Privilege HTTP in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Business Intelligence
Oracle Corporation Oracle Business Intelligence Enterprise Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:38.561Z

Reserved: 2026-08-31T15:40:57.350Z

Link: CVE-2026-83282

cve-icon Vulnrichment

Updated: 2026-09-17T13:00:38.803Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:40.820

Modified: 2026-09-17T14:17:39.113

Link: CVE-2026-83282

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T02:00:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management