CVE-2026-91535 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Search component of Oracle Business Intelligence Enterprise Edition, a critical module responsible for indexing and retrieving data from various enterprise sources to support analytical reporting. This flaw affects multiple supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, indicating that the issue is not isolated to a single release cycle but persists across different iterations of the software architecture. The vulnerability stems from insufficient input validation or improper access control mechanisms within the search functionality, allowing an attacker who has established network connectivity via HTTP to interact with the service in unintended ways. Because the attack vector requires only low-privileged user credentials and network access, it represents a significant risk for organizations that have not strictly segmented their BI environments or enforced rigorous authentication policies across all internal services.
From a technical perspective, this vulnerability is classified under CWE-287 Improper Authentication or potentially CWE-918 Server-Side Request Forgery depending on the specific exploitation mechanism utilized by the attacker to compromise the search engine's integrity. The ability of an unprivileged user to escalate privileges through HTTP requests suggests that the application fails to adequately verify whether the requesting entity has sufficient rights to execute certain administrative functions or access sensitive data structures within the BI repository. This misalignment between expected privilege levels and actual enforcement allows for a complete takeover of the Oracle Business Intelligence Enterprise Edition instance. Once compromised, an attacker can manipulate search results, inject malicious payloads into reports, or potentially leverage the underlying server environment to execute arbitrary code if further exploitation chains are available.
The operational impact of this vulnerability is severe, as reflected by its CVSS 3.1 base score of 8.8 which indicates a High severity rating with significant impacts on confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires low complexity, does not require user interaction, and results in high impact across all three security triads for an unmodified system. In a business context, this means that sensitive corporate data indexed by BI Search could be exfiltrated without detection, critical reports could be altered to mislead decision-makers, or the entire analytics platform could be rendered unavailable through denial-of-service techniques enabled by the same flaw. This compromises not only the technical infrastructure but also the trust in organizational intelligence and reporting capabilities.
Mitigation strategies must focus on immediate patching of all affected versions using official Oracle Critical Patch Update releases that address this specific component vulnerability. In addition to applying patches, organizations should implement network segmentation to restrict HTTP access to BI services from untrusted or low-privileged networks. Deploying a Web Application Firewall with rules specifically tuned for SQL injection and path traversal attacks can provide an additional layer of defense against exploitation attempts while patch management processes are updated. Furthermore, enforcing strict role-based access control within the Oracle Analytics environment ensures that even if network boundaries are breached, lateral movement to critical administrative functions is restricted by principle of least privilege. Regular auditing of user permissions and monitoring for anomalous search queries can also aid in early detection of potential exploitation activities aligned with ATT&CK techniques such as T1059 Command Scripting or T1078 Valid Accounts if the attacker attempts to maintain persistence after initial compromise.