Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Assess Impact
AI Analysis

Impact

This vulnerability exists in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition. It permits a low‑privileged attacker with network access over HTTP to read a subset of data that should be restricted. The weakness is an information disclosure flaw, corresponding to improper handling of access controls that allows confidential data to be exposed to unauthorized users.

Affected Systems

Oracle Corporation’s Oracle Business Intelligence Enterprise Edition – version 26.01.0.0.0.

Risk and Exploitability

The CVSS 3.1 score of 4.3 indicates moderate severity with a low impact on confidentiality. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV database, suggesting no widespread exploitation yet. The likely attack vector involves a remote attacker exploiting the HTTP interface to request privileged data from the Visual Analyzer module.

Generated by OpenCVE AI on October 21, 2026 at 11:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Business Intelligence Enterprise Edition once it is released.
  • Restrict HTTP access to the BI instance to trusted IP ranges or internal networks.
  • Disable or limit the Visual Analyzer feature if it is not needed for business operations.

Generated by OpenCVE AI on October 21, 2026 at 11:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Visual Analyzer in Oracle Business Intelligence
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer). The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:38:55.972Z

Reserved: 2026-09-14T22:10:16.647Z

Link: CVE-2026-91600

cve-icon Vulnrichment

Updated: 2026-10-26T20:38:50.470Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:00.770

Modified: 2026-10-26T21:20:53.170

Link: CVE-2026-91600

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:15:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor