An unauthenticated attacker who has local logon access to the infrastructure running Oracle Business Intelligence Enterprise Edition can exploit a vulnerability in the Analytics Server to compromise the application. The flaw permits local attackers to perform actions that ultimately result in the complete takeover of the BI Enterprise Edition instance, affecting confidentiality, integrity, and availability of the data and services it hosts. This weakness is categorized as a significant authentication and access control issue.

Oracle Business Intelligence Enterprise Edition is affected in both major release lines: version 8.2.0.0.0 and version 12.2.1.4.0. The vulnerability impacts the Analytics Server component of the Oracle Analytics stack.

The vulnerability is assigned a CVSS v3.1 base score of 7.8, indicating high severity. The associated vector describes local attack (AV:L), low complexity (AC:L), no privileges required (PR:N), and requires user interaction (UI:R). Elastic exploitation on an unpatched system is possible, but it requires human interaction from a person other than the attacker. The EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog. Given the high CVSS score and local nature of the exploit, organizations should consider the risk to be substantial if exposed to environments that allow local logons to the BI host.