CVE-2026-91534 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Web General component of Oracle Business Intelligence Enterprise Edition, a critical enterprise analytics platform used for data visualization and reporting across various organizational sectors. This flaw affects multiple supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, indicating that legacy systems as well as more recent deployments are susceptible to exploitation. The nature of this vulnerability is particularly concerning because it allows for unauthenticated access, meaning an attacker does not need valid credentials or prior interaction with the system to initiate a successful attack vector. This characteristic significantly lowers the barrier to entry for malicious actors and increases the likelihood of automated scanning tools targeting these specific endpoints on public-facing networks.
From a technical perspective, the vulnerability is exploitable via HTTP, which suggests that the flaw likely involves improper input validation or state management within the web application layer. The ability to cause a hang or frequently repeatable crash points towards a denial-of-service condition, often resulting from memory corruption issues such as buffer overflows, integer overflows, or logic errors in request handling routines. When an attacker sends specially crafted HTTP requests containing malformed data or specific sequences of operations, the server fails to handle these inputs gracefully, leading to resource exhaustion or application instability. This operational impact directly compromises the availability aspect of the CIA triad, rendering the business intelligence platform inaccessible to legitimate users and disrupting critical decision-making processes that rely on real-time or scheduled analytics reports.
Beyond the immediate denial-of-service capability, this vulnerability also permits unauthorized modifications to data accessible through Oracle Business Intelligence Enterprise Edition. The attacker can perform update, insert, or delete operations against certain datasets managed by the system. This represents a severe integrity violation where an adversary could alter historical records, inject false metrics into dashboards, or permanently remove critical analytical data. Such tampering undermines trust in organizational reporting and can lead to significant financial or strategic losses if decisions are based on corrupted information. Furthermore, the vulnerability grants unauthorized read access to a subset of accessible data, constituting a confidentiality breach that could expose sensitive business intelligence, customer analytics, or proprietary metrics to external parties without any form of authentication bypassing traditional security controls.
The severity of this issue is quantified by a CVSS 3.1 Base Score of 8.6, classified as High Severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) highlights that while the impact on confidentiality and integrity is limited to low levels due to subset access or partial data exposure, the availability impact is high due to the reliable crash capability. The attack vector being network-based with low complexity and no required user interaction makes this a prime target for automated exploitation campaigns. In terms of industry standards, this vulnerability aligns closely with CWE-20 Improper Input Validation, as the root cause likely stems from insufficient sanitization of HTTP parameters or headers. Additionally, the ability to crash the service maps to CWE-400 Uncontrolled Resource Consumption, while the unauthorized data access corresponds to CWE-862 Missing Authorization and CWE-798 Use of Hard-coded Credentials if authentication bypass is involved in related attack chains.
To mitigate this risk, organizations must prioritize applying the latest security patches provided by Oracle for all affected versions immediately. Since the vulnerability allows unauthenticated exploitation over HTTP, it is imperative to ensure that Oracle Business Intelligence Enterprise Edition instances are not directly exposed to the public internet without robust perimeter defenses such as Web Application Firewalls configured with rulesets capable of detecting and blocking anomalous request patterns associated with buffer overflow or denial-of-service attempts. Implementing strict network segmentation to restrict access to internal management interfaces can also reduce the attack surface. Regular vulnerability scanning should be conducted to identify unpatched instances, and logging mechanisms should be enhanced to detect repeated failed requests or unusual spikes in resource usage that may indicate an ongoing exploitation attempt. Continuous monitoring for signs of data integrity violations is essential given the potential for silent tampering alongside overt denial-of-service attacks.