A vulnerability exists in the Analytics Server component of Oracle Business Intelligence Enterprise Edition that permits a low‑privileged attacker with network access via HTTP to compromise and fully take over the system. The vulnerability carries a CVSS 3.1 Base Score of 8.8, indicating high severity and giving an attacker confidentiality, integrity, and availability impacts. Successful exploitation results in a complete system compromise rather than a limited privilege escalation.

The affected vendor and product are Oracle Corporation’s Oracle Business Intelligence Enterprise Edition. The specific versions impacted are 8.2.0.0.0 and 26.01.0.0.0.

The CVSS score of 8.8 and the lack of an EPSS rating imply that the vulnerability is considered serious but the precise exploitation likelihood remains unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the exposed HTTP interface, requiring only low privilege credentials or none, and then gain full control of the BI server.