Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Partial denial of service via HTTP request
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in Oracle Business Intelligence Enterprise Edition, allowing a low‑privileged attacker who can reach the system over HTTP to trigger a partial denial of service. The flaw is exploitable via normal network traffic and is categorized as an availability issue with a CVSS v3.1 base score of 4.3. The impact is limited to interrupting or degrading service availability, with no compromise of confidentiality or integrity.

Affected Systems

Affected is Oracle Corporation Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0, the supported edition of Oracle Analytics. Only this exact version is listed as vulnerable; no other product versions are known to be impacted by this issue.

Risk and Exploitability

The risk rating is moderate due to the low CVSS score and the AV:N/AC:L/PR:L vector, indicating that an attacker must possess some local or compromised privilege within the network. The EPSS score is not available, so the likelihood of exploitation is currently unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a network‑based HTTP request from a low‑privileged host that may be able to send specially crafted input to the BI Foundation component, leading to resource exhaustion and a service interruption.

Generated by OpenCVE AI on October 21, 2026 at 10:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s security website for the latest patch that addresses this availability issue and install it on all affected Oracle BI Enterprise Edition instances.
  • Limit HTTP access to the BI Foundation component to trusted IP addresses or VPN users, reducing the attack surface for low‑privileged requests.
  • Configure monitoring and rate‑limiting on the BI server to detect and mitigate repeated HTTP requests that could trigger resource exhaustion, and review logs for anomalous patterns.
  • Apply network segmentation and firewall rules to block potentially malicious traffic before it reaches the BI server.

Generated by OpenCVE AI on October 21, 2026 at 10:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Attack Can Trigger Partial Denial of Service in Oracle BI Enterprise Edition
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:58:31.478Z

Reserved: 2026-09-14T22:10:16.641Z

Link: CVE-2026-91524

cve-icon Vulnrichment

Updated: 2026-10-26T19:58:25.608Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:56.370

Modified: 2026-10-26T20:19:47.140

Link: CVE-2026-91524

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:15:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption