Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

The Oracle Business Intelligence Enterprise Edition product contains a flaw in the BI Search component that allows a low‑privilege attacker who can reach the service over HTTP to bypass authentication and execute arbitrary code. The vulnerability, identified as a failure to enforce authentication for privileged functionality, can result in full compromise of the BI server, exposing confidential data and disrupting service availability.

Affected Systems

Oracle Business Intelligence Enterprise Edition, released by Oracle Corporation, is affected in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0.

Risk and Exploitability

The CVSS base score of 8.8 indicates high severity. An attacker only needs network access and low privileges, and the vector is HTTP, making exploitation straightforward in exposed environments. The EPSS score of less than 1% shows a very low but non‑zero likelihood of exploitation, and the vulnerability is not yet listed in CISA KEV.

Generated by OpenCVE AI on October 27, 2026 at 10:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and apply the patch or update released in the Oracle CPU Oct 2026 advisory for Business Intelligence Enterprise Edition.
  • Restrict HTTP access to the BI server to trusted IP addresses or VPN endpoints to limit network exposure.
  • If the BI Search feature is not required, disable or uninstall it to remove the vulnerable functionality.

Generated by OpenCVE AI on October 27, 2026 at 10:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access in BI Search Component Allows Remote Code Execution

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Low-Privileged HTTP Exploit in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284
CWE-287

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Low-Privileged HTTP Exploit in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:05:10.409Z

Reserved: 2026-09-14T22:10:16.642Z

Link: CVE-2026-91535

cve-icon Vulnrichment

Updated: 2026-10-26T20:05:04.448Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:57.183

Modified: 2026-10-26T21:20:40.497

Link: CVE-2026-91535

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:15:18Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function