The vulnerability exists in the Presentation Services component of Oracle Business Intelligence Enterprise Edition. An attacker who has low-privileged access and is able to log into the same infrastructure can exploit this weakness to compromise the BI environment, potentially leading to a full takeover. The impact includes confidentiality, integrity, and availability loss, as reflected in the CVSS vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The affected product is Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0, as identified by the Oracle CNA. The vulnerability is limited to this version in the Presentation Services component and there are no other affected releases listed.

The CVSS base score of 7.8 indicates high risk but the attack requires local access with low privileges; it does not involve network exposure. Because the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the current exploit probability is very low, but the local nature of the attack means that an organization with any internal user having enough privileges to execute code on the BI server faces a serious threat.