This vulnerability allows an attacker with low privileges and network access via HTTP to carry out unauthorized update, insert, or delete operations on data in Oracle Business Intelligence Enterprise Edition, as well as read restricted data. The attack requires an additional person to perform a human interaction step. The weakness resides in the Analytics Web General component and results in confidentiality and integrity impacts, as reflected by the CVSS score for medium severity.

Affected products include Oracle Business Intelligence Enterprise Edition for versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. These versions are listed in the Oracle Security Advisory for October 2026 and are susceptible to exploitation.

The CVSS score of 5.4 indicates a medium threat level. The EPSS score is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote over HTTP, requiring an attacker to act through a web interface and to involve a separate user for the interaction step. Successful exploitation could compromise the confidentiality and integrity of data accessible through the Oracle Business Intelligence platform, potentially impacting additional integrated products due to scope change.