The vulnerability lies within the Analytics Web Administration component of Oracle Business Intelligence Enterprise Edition. A high‑privileged attacker who can reach the system over HTTP can exploit this weakness with relative ease, resulting in a complete takeover of the BIEE platform. Successful exploitation gives the attacker total control, enabling full theft or modification of data, and complete disruption of business service availability. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms that the attack is network‑based, requires high authority, and carries catastrophic confidentiality, integrity, and availability impacts.

Oracle Corporation’s Oracle Business Intelligence Enterprise Edition is affected, specifically the 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 releases. The weakness resides in the web‑administration component of Oracle Analytics. Because the vector indicates a scope change, other Oracle products that are integrated with BIEE could also be impacted, but the primary affected product is BIEE itself.

With a CVSS base score of 9.1 the vulnerability is rated critical. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, yet the description states it is easily exploitable by a network attacker possessing high privileges. The likely attack path is remote via HTTP to the web‑admin interface, where an attacker with administrative credentials or other elevated access may issue commands that result in full compromise. The lack of a publicly disclosed workaround implies that the immediate risk rests on whether the patch is applied promptly.