Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-09-15
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access and Modification
Action: Patch Now
AI Analysis

Impact

The flaw is a low‑privilege remote access issue in the Analytics Actions component of Oracle Business Intelligence Enterprise Edition. An attacker who can reach the HTTP interface may bypass access controls and read or modify sensitive data exposed by the platform, compromising confidentiality and some integrity of the protected information. The weakness allows unauthorized insertion, update, or deletion of data that the BI platform makes available, potentially affecting all data accessible through the BI system. The issue involves improper access control (CWE-284).

Affected Systems

Vulnerable versions are 8.2.0.0.0 and 26.01.0.0.0 of Oracle Business Intelligence Enterprise Edition. The issue resides in the Analytics Actions component and may extend to other Oracle Analytics products because the vulnerability can change scope.

Risk and Exploitability

The CVSS v3.1 base score of 8.5 denotes high severity. The EPSS score is below 1 %, indicating a low current probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Attackers require only network reachability via HTTP and low privileges; no user interaction or elevated rights are needed. Given the potential scope change, an exploit could expose all data accessible through the BI platform.

Generated by OpenCVE AI on September 21, 2026 at 23:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch or upgrade to a version of Oracle Business Intelligence Enterprise Edition that addresses the Analytics Actions flaw, as detailed in Oracle’s security alert.
  • Restrict network exposure of the Analytics Actions API by limiting access to trusted internal networks or by placing it behind a firewall or reverse proxy that authenticates clients.
  • Monitor HTTP traffic to the BI Enterprise Edition for anomalous requests to the Analytics Actions endpoints and review system logs for evidence of unauthorized data modifications.

Generated by OpenCVE AI on September 21, 2026 at 23:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Access to Oracle BI Enterprise Edition
Weaknesses CWE-285

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Access to Oracle BI Enterprise Edition
Weaknesses CWE-285

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Access Leading to Unauthorized Data Modification in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Thu, 17 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Access Leading to Unauthorized Data Modification in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T19:13:29.723Z

Reserved: 2026-08-31T15:40:57.352Z

Link: CVE-2026-83321

cve-icon Vulnrichment

Updated: 2026-09-21T19:13:25.660Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:45.200

Modified: 2026-09-21T20:17:33.950

Link: CVE-2026-83321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T23:30:18Z

Weaknesses