CVE-2026-91545 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Platform Security component of Oracle Business Intelligence Enterprise Edition, a critical enterprise analytics platform used by organizations for data visualization and reporting. This flaw affects specific legacy versions including 8.2.0.0.0 and 12.2.1.4.0, indicating that older deployments or those with delayed patching cycles are at significant risk. The nature of this vulnerability is particularly concerning because it allows an unauthenticated attacker to compromise the system, provided they have network-level access to the infrastructure where the application executes. This implies that while remote exploitation over a wide area network may not be directly possible without prior authentication or proximity, local attackers on the same subnet or those who have gained initial foothold through other means can leverage this flaw for further escalation. The vulnerability is classified with a CVSS 3.1 Base Score of 7.8, which denotes a High severity rating due to its potential to fully compromise confidentiality, integrity, and availability.
Technically, the exploit chain requires human interaction from a user other than the attacker, which aligns with social engineering vectors or phishing scenarios where an unsuspecting administrator or end-user is tricked into performing an action that triggers the vulnerability. This characteristic maps closely to CWE-79, commonly known as Cross-Site Scripting (XSS), although in enterprise BI contexts it may also involve insecure deserialization or improper validation of user-supplied input within platform security modules. The requirement for human interaction suggests that the attack vector likely involves manipulating a web interface or report generation feature where malicious code is embedded and executed upon viewing or interacting with specific content. This behavior is consistent with ATT&CK technique T1059, Command and Scripting Interpreter, as it allows an attacker to execute arbitrary commands within the context of the application server after gaining initial access through social engineering.
The operational impact of a successful exploitation is severe, resulting in complete takeover of Oracle Business Intelligence Enterprise Edition. This means attackers can read sensitive data stored within reports and dashboards, modify existing configurations or content, and potentially disrupt service availability by crashing services or consuming resources maliciously. Since the platform often serves as a central hub for organizational analytics, compromising it exposes proprietary business intelligence, customer data, and strategic insights to unauthorized parties. The high impact on confidentiality is driven by the ability to access underlying databases through compromised connections, while integrity impacts arise from the potential to alter reports or inject misleading data that influences executive decision-making. Availability impacts stem from the possibility of causing denial-of-service conditions through resource exhaustion or service disruption techniques enabled by administrative control gained via this vulnerability.
Mitigation strategies must prioritize immediate patching for all affected versions 8.2.0.0.0 and 12.2.1.4.0, as Oracle typically releases security patches to address such critical flaws in the Platform Security component. Organizations should verify their deployment status using official support documentation and apply the latest available updates or interim fixes provided by Oracle Support. In environments where immediate patching is not feasible due to operational constraints, network segmentation strategies should be implemented to restrict access to the BI infrastructure from untrusted networks. Additionally, implementing strict input validation at any proxy or gateway layer in front of the application can help mitigate exploitation attempts involving malicious payloads. Security awareness training for users who interact with shared reports and dashboards is also essential to reduce the risk of social engineering attacks that trigger this vulnerability. Regular audits of user permissions and monitoring for anomalous activities within the BI platform will further enhance detection capabilities against potential exploitation attempts leveraging this flaw.