Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Application Takeover
Action: Immediate Patch
AI Analysis

Impact

The platform security component of Oracle Business Intelligence Enterprise Edition contains a CWE‑269 access‑control flaw that allows a high‑privileged attacker with network connectivity over HTTP to gain full control of the application, potentially compromising confidentiality, integrity, and availability of all BI services.

Affected Systems

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0, both supported by Oracle, are affected. The servers are exposed over HTTP on the network.

Risk and Exploitability

The CVSS base score of 7.2 indicates a medium‑high severity; the EPSS score of < 1% suggests a low likelihood of exploitation, but the vulnerability requires only high‑privileged credentials and an HTTP request, making it feasible for attackers who have breached the network or have valid accounts. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 20, 2026 at 08:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses this vulnerability to all affected Oracle Business Intelligence Enterprise Edition deployments.
  • Limit HTTP exposure by implementing strict firewall rules or placing the BI servers behind a VPN or application gateway, permitting access only from trusted hosts.
  • Enforce least privilege on application and operating‑system accounts, disable unused modules or services to reduce the attack surface, and segment the BI network from other critical systems.
  • Enable and monitor audit logs for privileged actions on the BI service to detect anomalous activity.

Generated by OpenCVE AI on September 20, 2026 at 08:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition
Vendors & Products Oracle Corporation
Oracle Corporation oracle Business Intelligence Enterprise Edition

Sun, 20 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Title Access Control Vulnerability in Oracle Business Intelligence Enterprise Edition Enables Application Takeover

Fri, 18 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Title Externally Exploitable Platform Security Flaw in Oracle Business Intelligence Enterprise Edition Allows High-Privilege Takeover
Weaknesses CWE-284
CWE-285

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Title Externally Exploitable Platform Security Flaw in Oracle Business Intelligence Enterprise Edition Allows High-Privilege Takeover
Weaknesses CWE-284
CWE-285

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Business Intelligence
Oracle Corporation Oracle Business Intelligence Enterprise Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:26.869Z

Reserved: 2026-08-31T15:40:57.352Z

Link: CVE-2026-83322

cve-icon Vulnrichment

Updated: 2026-09-17T12:59:51.559Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:45.310

Modified: 2026-09-17T14:17:41.310

Link: CVE-2026-83322

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T01:45:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management