The CVE describes a vulnerability in the BI Foundation component of Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) that allows an unauthenticated attacker with network access via HTTP to take full control of the affected system. Because the vulnerability can lead to a total takeover, it is classified as a remote code execution flaw that compromises confidentiality, integrity, and availability. The CVSS vector indicates a difficult exploitation path (high attack complexity) but no user interaction is required, meaning that remote attackers can achieve full compromise without any prior authentication.

Oracle Corporation's Business Intelligence Enterprise Edition version 12.2.1.4.0 is affected. As stated by Oracle in their CPU alert for October 2026, this issue exists in the BI Foundation module. No other product versions or deployment scenarios are currently reported as impacted.

The CVSS base score of 8.1 places the flaw in the severe range, and the EPSS score of 0.00294 indicates a low but non‑zero probability of exploitation. Given the unauthenticated nature and HTTP-based attack vector, adversaries could mount the exploit from any network that can reach the BI server. The vulnerability is not listed in the CISA KEV catalog, but the high impact and accessibility warrant immediate remedial action.