A vulnerability in Oracle Business Intelligence Enterprise Edition allows a low privileged user who has logged on to the underlying infrastructure to compromise the BI service. The flaw is difficult to exploit, requires local access, a high complexity to exploit, and does not need user interaction. Successful exploitation results in full loss of confidentiality, integrity, and availability of the BI platform, as the attacker can effectively take over the service.

Oracle Corporation’s Oracle Business Intelligence Enterprise Edition (BI Foundation component) of Oracle Analytics 12.2.1.4.0 is affected.

The CVSS v3.1 Base Score of 7.0 indicates a high severity, but the problem is local‑only and requires an attacker to already have a low‑privilege login on the host. The EPSS score is 0.001, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting there is no confirmed exploitation traffic yet. Nevertheless, because the effect is a full takeover of the BI service, the threat is significant for organizations that host this product and rely on it for analytics and reporting.