The vulnerability arises in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition (BI EE). An unauthenticated attacker with network access through HTTP can exploit a flaw that allows the attacker to trigger application hangs, forced reboots, or crashes. The same flaw also permits the attacker to read, insert, update, or delete protected data. The CVSS base score of 8.6 reflects low confidentiality and integrity impact but a high availability impact. Based on the description, the likely attack vector is a network-based request sent to the BI EE web interface without authentication.

Affected are Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, which are listed by Oracle as vulnerable in the Advisory. The products are identified in CPEs that include the enterprise edition product for any supported instance.

With an unpatched system, the flaw is considered highly exploitable because it requires only network connectivity plus knowledge of the BI EE URL. The high CVSS score indicates significant potential damage, and because the flaw allows direct manipulation of data as well as denial of service, the operational risk is severe. The EPSS score of < 1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the attack surface remains broad due to the web accessibility of the target. Immediate remediation is recommended.