The vulnerability exists in Oracle Business Intelligence Enterprise Edition, specifically within the platform security component. It allows an attacker to compromise the system by accessing a physical communication segment associated with the hardware where the product runs. This design flaw enables an unauthenticated attacker, once physically connected, to cause a full takeover, affecting confidentiality, integrity, and availability. The vulnerability involves a scope change, indicating that successful exploitation can also impact other Oracle products that rely on the compromised BI system.

Oracle Corporation’s Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 are affected; no other products or versions are listed as impacted in the data provided.

The base CVSS 3.1 score is 8.3, reflecting high severity and wide impact. The attack vector is physical access (adjacent network) with high attack complexity and no user interaction, meaning the attacker needs only to connect to the hardware’s communication segment. EPSS is not available, but the lack of an official KEV listing indicates that no known exploitation has been reported yet. Nevertheless, given the scope change and the full takeover potential, the risk remains high, and organizations should treat this as a critical vulnerability.