CVE-2026-91546 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Foundation component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0 and potentially other versions in the supported lifecycle. This flaw represents a critical security deficiency that allows an unauthenticated attacker to compromise the integrity and availability of the application infrastructure. The severity is underscored by a CVSS v3.1 base score of 8.1, indicating a High risk level due to significant impacts on confidentiality, integrity, and availability. Although the vulnerability requires high complexity for exploitation, its accessibility via standard HTTP protocols without any prior authentication makes it particularly dangerous in environments where web-facing services are exposed to untrusted networks or the public internet.
From a technical perspective, this flaw likely stems from improper input validation or access control mechanisms within the BI Foundation layer. The ability of an attacker with network access to trigger the vulnerability suggests that specific HTTP requests can manipulate internal application states or execute unintended operations without passing through standard authentication gates. This aligns with common weaknesses categorized under CWE-287, which involves Improper Authentication, and potentially CWE-918, reflecting Server-Side Request Forgery if the flaw allows interaction with internal services. The high complexity of exploitation implies that specific conditions or precise sequence of actions are required to successfully leverage the defect, such as crafting a specially formatted HTTP request payload that bypasses existing security checks.
The operational impact of this vulnerability is severe, potentially leading to complete takeover of the Oracle Business Intelligence Enterprise Edition environment. An attacker who successfully exploits this flaw could gain unauthorized access to sensitive business intelligence data, modify reports and dashboards, or disrupt service availability by crashing application processes. This directly impacts the confidentiality of proprietary analytics, the integrity of decision-making metrics derived from BI tools, and the availability of critical reporting services essential for enterprise operations. The lack of authentication requirement means that any entity with network connectivity to the affected server can attempt exploitation, increasing the attack surface significantly in cloud or DMZ deployments.
Mitigation strategies must prioritize immediate isolation and patching. Organizations running version 12.2.1.4.0 should apply the latest security patches provided by Oracle as soon as they are available for this specific component. In the interim, if patching is not immediately feasible, it is critical to restrict network access to the BI Foundation endpoints using firewall rules or web application firewalls that block suspicious HTTP patterns associated with exploitation attempts. Additionally, implementing strict input validation and ensuring that all administrative interfaces enforce robust authentication mechanisms can help mitigate similar risks. Monitoring logs for unusual HTTP activity targeting this component will aid in early detection of attempted exploits.
This vulnerability maps to the MITRE ATT&CK framework under techniques related to Initial Access and Privilege Escalation, specifically reflecting how attackers leverage application layer vulnerabilities to gain footholds within enterprise systems. Understanding these mappings helps security teams align their defense strategies with industry-standard threat models. Continuous monitoring for indicators of compromise associated with BI tool exploitation is recommended alongside regular vulnerability assessments to ensure that such gaps do not persist in the production environment.