CVE-2026-91524 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Foundation component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0. This software is a core part of Oracle Analytics and serves as the underlying engine for business intelligence operations, handling data processing, reporting, and visualization tasks. The presence of this flaw indicates a weakness in how the application handles specific requests or processes internal logic under certain conditions, which can be triggered by external interactions with the system.
The technical nature of this vulnerability allows an attacker to exploit it through standard HTTP network connections without requiring any user interaction or complex setup. A critical aspect of this exploitation vector is that it requires only low-privileged access on the target network. This means that an adversary does not need administrative credentials or elevated privileges within the Oracle environment to initiate the attack, significantly lowering the barrier for entry and increasing the likelihood of successful compromise by opportunistic attackers scanning for accessible services.
Upon successful exploitation, the primary impact is a partial denial of service against the Oracle Business Intelligence Enterprise Edition. This means that while the system may not be completely offline or unresponsive in all aspects, its functionality is degraded to such an extent that legitimate users cannot perform essential tasks effectively. The availability of critical reporting features, dashboard loading times, and data retrieval operations are impaired, disrupting business continuity for organizations relying on these analytics tools for decision-making processes.
From a classification perspective, this vulnerability aligns with CWE-400, which covers uncontrolled resource consumption leading to denial of service conditions. It also maps to the ATT&CK framework under techniques related to Resource Hijacking or Service Exhaustion attacks, where an adversary aims to degrade system performance rather than steal data or modify configurations. The CVSS 3.1 base score of 4.3 reflects a medium severity level driven primarily by availability impacts, with no direct consequences on confidentiality or integrity as indicated by the vector components C:N and I:N.
Mitigation strategies should focus on immediate patching to the latest supported version provided by Oracle, which addresses the underlying code flaw causing the resource exhaustion. In cases where patching is not immediately feasible, network-level controls such as firewalls or web application firewalls can be configured to rate-limit HTTP requests directed at the BI Foundation endpoints. Additionally, restricting access to low-privileged users who do not require full system interaction can reduce the attack surface by limiting the number of potential actors capable of triggering the vulnerability through their existing permissions.