CVE-2026-91523 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Web General component of Oracle Business Intelligence Enterprise Edition, a core part of the Oracle Analytics suite. This security flaw affects multiple supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The nature of this vulnerability allows for exploitation by an attacker with low privileges who has network access via HTTP to the affected system. While the initial entry point is relatively accessible due to the low attack complexity and network vector, successful exploitation requires human interaction from a user other than the attacker. This social engineering aspect suggests that the flaw likely involves some form of诱骗 or unintended action by an authenticated user, such as clicking on a malicious link or interacting with compromised content within the web interface.
From a technical perspective, this vulnerability represents a significant breach in data integrity and confidentiality controls. The successful exploitation leads to unauthorized updates, inserts, or deletes against accessible data within Oracle Business Intelligence Enterprise Edition. This indicates that an attacker can modify critical business intelligence reports, dashboards, or underlying datasets without proper authorization. Furthermore, the vulnerability also permits unauthorized read access to a subset of accessible data, allowing for potential information disclosure. The impact extends beyond the immediate application due to scope change characteristics, meaning that compromising this component could potentially affect other integrated products within the Oracle ecosystem, amplifying the overall risk profile significantly.
The operational impact is substantial given the CVSS 3.1 base score of 5.4 which reflects moderate severity driven by both confidentiality and integrity impacts but no availability loss. The attack vector classification as network-accessible with low complexity makes it feasible for remote attackers to attempt exploitation, although the requirement for user interaction serves as a partial mitigation factor. However, in enterprise environments where users frequently interact with shared reports or external links embedded within BI dashboards, this barrier can be easily bypassed through social engineering tactics. The ability to alter data integrity poses severe risks including financial fraud, regulatory non-compliance due to tampered records, and erosion of trust in analytical outputs used for strategic decision-making.
In terms of industry standards mapping, this vulnerability aligns with CWE-79 which covers Cross-site Scripting vulnerabilities if the mechanism involves injecting malicious scripts into web pages viewed by other users. It also relates to CWE-269 concerning Improper Privilege Management where low privileged accounts gain elevated capabilities through specific interactions. From an ATT&CK framework perspective, this behavior corresponds to techniques involving Valid Accounts and potentially Account Manipulation or Data Staged if the attacker uses the compromised access for further lateral movement. The scope change aspect highlights the importance of understanding application dependencies in complex enterprise architectures like Oracle Analytics Cloud.
Mitigation strategies should prioritize immediate patching by applying the latest security updates provided by Oracle for all affected versions listed above. Organizations must ensure that their update management processes are agile enough to deploy these patches promptly across production environments. Additionally, implementing strict input validation and output encoding on the web interface can help prevent exploitation of similar flaws in related components. Security awareness training should be reinforced to educate users about the risks of interacting with untrusted content within business applications, thereby reducing the likelihood of successful human interaction-based attacks. Network segmentation and Web Application Firewalls may also provide an additional layer of defense by monitoring for anomalous HTTP requests that match known exploitation patterns associated with this vulnerability class.