CVE-2026-71094 in Business Intelligence Enterprise Edition
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability resides within the Presentation Services component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0 which is part of the broader Oracle Analytics suite. This security flaw represents a significant risk to organizations relying on this platform for data visualization and business intelligence operations. The core issue stems from an easily exploitable condition that allows an attacker with low privileges who has already established logon access to the infrastructure hosting the application to compromise the system. Unlike many vulnerabilities that require complex exploitation chains or high-level administrative rights, this flaw leverages existing authenticated sessions combined with specific user interactions to escalate impact beyond standard permissions.
From a technical perspective, the vulnerability is characterized by its reliance on human interaction from a party other than the attacker for successful execution. This social engineering aspect suggests that the exploit likely involves tricking an authorized user into performing an action or clicking a malicious link within the interface, which then triggers the underlying code flaw in the Presentation Services layer. Once triggered, this mechanism allows the low-privileged attacker to take complete control of the Oracle Business Intelligence Enterprise Edition environment. The severity is quantified by a CVSS 3.1 Base Score of 7.3, indicating a High severity rating that reflects substantial impacts on confidentiality, integrity, and availability.
The operational impact of such a compromise is severe for enterprise environments. Since Presentation Services handles the rendering of reports and dashboards to end-users, gaining control over this component effectively grants an attacker dominance over the entire analytics platform. This can lead to unauthorized access to sensitive corporate data displayed in reports, manipulation of key performance indicators or financial metrics presented to stakeholders, and potential disruption of business operations by altering available views or causing service outages. The ability to achieve full takeover means that attackers could exfiltrate proprietary information, alter decision-making processes based on tampered analytics, or use the compromised system as a pivot point for further attacks against connected data warehouses or backend systems.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 which covers Cross-site Scripting vulnerabilities if the exploitation involves injecting malicious scripts into web pages viewed by other users. It also relates to CWE-200 where information exposure occurs due to insufficient access controls or logic flaws in authenticated sessions. From a tactical standpoint within the MITRE ATT&CK framework, this scenario maps to techniques involving Valid Accounts and potentially User Execution, as it requires an attacker with legitimate credentials to leverage social engineering against other users to achieve privilege escalation and system compromise. The vector AV:L indicates local network access is sufficient for initial foothold acquisition, while AC:L suggests low complexity in exploitation once the prerequisite conditions are met.
Mitigation strategies must address both the technical flaw and the human element of the attack chain. Oracle should be consulted immediately for available patches or updates that resolve this specific issue within version 12.2.1.4.0. In the interim, organizations should enforce strict least-privilege principles to ensure that even if an attacker gains low-level access, their ability to interact with critical Presentation Services endpoints is restricted where possible. Security awareness training is crucial to mitigate the human interaction requirement; users must be educated on recognizing suspicious links or actions within the BI interface that could trigger such exploits. Additionally, implementing robust input validation and output encoding at the application layer can help prevent the execution of malicious payloads if similar flaws exist in related components. Network segmentation should also be reviewed to limit lateral movement opportunities for attackers who have already compromised a low-privileged account on the hosting infrastructure.