Description
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access (Confidentiality)
Action: Assess Impact
AI Analysis

Impact

The vulnerability in the Oracle Business Intelligence Enterprise Edition analytics server permits a low‑privileged attacker who can reach the server over HTTP to read restricted data. The flaw bypasses normal authorization checks, granting read access to data that should be protected, without affecting integrity or availability. Attacks are possible only if the attacker can reach the analytics server and has low privileges on the target host.

Affected Systems

Oracle Business Intelligence Enterprise Edition is impacted. The affected releases are 8.2.0.0.0 and 26.01.0.0.0. Only the Analytics Server component is susceptible.

Risk and Exploitability

With a CVSS v3.1 base score of 4.3, the vulnerability poses a moderate risk to confidentiality. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred from the description as network access via HTTP from a low‑privileged user; no elevation or code execution is required. Because the impact is limited to read‑only data, the exploitation risk is lower than high‑severity flaws but still warrants attention.

Generated by OpenCVE AI on October 21, 2026 at 11:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or update for Oracle Business Intelligence Enterprise Edition to address the vulnerability.
  • Restrict network access to the analytics server to trusted hosts or VLANs and enforce strong authentication to limit low‑privileged exposure.
  • Implement role‑based access controls at the application level to ensure users have no more permission than required for their duties.

Generated by OpenCVE AI on October 21, 2026 at 11:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via Low-Privilege HTTP in Oracle Business Intelligence Enterprise Edition
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle business Intelligence
CPEs cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*
Vendors & Products Oracle
Oracle business Intelligence
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Business Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:42:18.646Z

Reserved: 2026-09-14T22:10:16.647Z

Link: CVE-2026-91607

cve-icon Vulnrichment

Updated: 2026-10-26T20:42:11.655Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:00.990

Modified: 2026-10-26T21:20:53.997

Link: CVE-2026-91607

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:15:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control