CVE-2026-91241 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Web Administration component of Oracle Business Intelligence Enterprise Edition, a critical enterprise analytics platform used for data visualization and reporting across various organizational sectors. This flaw affects multiple supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, indicating a persistent issue that has likely existed through several major releases of the software suite. The core technical nature of this vulnerability allows for an easily exploitable attack vector where a high-privileged attacker can leverage network access via HTTP to compromise the underlying system. Although the initial point of entry is within Oracle Business Intelligence Enterprise Edition, the impact extends beyond this specific application due to scope changes inherent in modern enterprise architectures. Successful exploitation leads to a complete takeover of the BI platform, which often serves as an administrative gateway or data hub connected to other critical systems such as databases, identity management services, and backend analytics engines. This lateral movement capability means that compromising one component can destabilize additional products within the same ecosystem, amplifying the risk profile significantly beyond what might be expected from a single application flaw.
From a technical perspective, the vulnerability exploits weaknesses in how the Analytics Web Administration interface handles requests or processes administrative commands over HTTP without sufficient validation or access control enforcement mechanisms appropriate for high-privilege operations. The requirement for network accessibility via HTTP suggests that the attack surface is exposed to internal networks or potentially external interfaces if not properly segmented by firewalls or reverse proxies with strict authentication policies. While the attacker must possess high privileges, this does not mitigate the severity because such accounts are often targeted through credential theft, insider threats, or privilege escalation attacks from lower-level compromised systems. The ease of exploitation implies that automated tools could be used to trigger the flaw once valid credentials are obtained, reducing the barrier for entry significantly compared to complex remote code execution vulnerabilities requiring specific payload crafting.
The operational impact of this vulnerability is severe, characterized by a CVSS 3.1 Base Score of 9.1, which denotes critical severity based on high impacts across confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) confirms that the attack is network-based with low complexity, requires no user interaction, but demands high privilege levels initially. However, once achieved, it results in complete compromise of all three security pillars. Confidentiality impact being high means sensitive business intelligence data, including proprietary reports and underlying dataset structures, can be exfiltrated or viewed by unauthorized parties. Integrity impact at the highest level indicates that an attacker could modify configurations, alter report outputs, or inject malicious logic into analytics workflows, leading to misinformation in decision-making processes. Availability impact suggests the ability to disrupt service, potentially causing denial of access for legitimate users and halting critical business operations dependent on real-time data insights.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-269 Improper Privilege Management or CWE-732 Incorrect Permission Assignment for Critical Resource, depending on the specific code path exploited within the web administration interface. In terms of MITRE ATT&CK framework mapping, this scenario corresponds to techniques involving Initial Access through Valid Accounts and subsequent Lateral Movement if the scope change allows pivoting to other systems. It also relates to Impact categories including Data Exfiltration over C2 channels or Service Disruption via resource exhaustion or configuration tampering. Organizations relying on Oracle Analytics must recognize that high-privilege administrative interfaces are prime targets for advanced persistent threats seeking long-term footholds within enterprise environments.
Mitigation strategies should prioritize immediate patching of the affected versions to 12.2.1.4.0 and above where fixes have been applied, or upgrading to newer supported releases like 26.01.0.0.0 if available in the customer environment. In cases where patching is not immediately feasible, strict network segmentation must be enforced to ensure that only authorized management networks can access the Analytics Web Administration endpoints. Implementing multi-factor authentication for all administrative accounts adds a crucial layer of defense against credential-based attacks. Additionally, deploying web application firewalls with rules specifically tuned to detect anomalous behavior in administration interfaces can help block exploitation attempts before they succeed. Regular auditing of privileged account usage and monitoring for unusual HTTP request patterns targeting BI admin pages will aid in early detection. Security teams should also review access controls to ensure that high-privilege accounts are used only when necessary, adhering to the principle of least privilege to reduce the blast radius if a compromise does occur.