CVE-2026-91549 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Server component of Oracle Business Intelligence Enterprise Edition, a critical enterprise analytics platform used for data visualization and reporting across various organizational infrastructures. This flaw affects specific legacy versions including 8.2.0.0.0 and 12.2.1.4.0, indicating that older deployments or those with delayed patching cycles are at significant risk. The nature of this vulnerability is particularly concerning because it allows an unauthenticated attacker to compromise the system, provided they have network-level access to the infrastructure where the Oracle Business Intelligence Enterprise Edition executes. This prerequisite suggests that while the attack does not require valid user credentials for authentication, it does demand physical or logical proximity to the target environment, classifying it as a local privilege escalation scenario in terms of initial access vector rather than a remote code execution flaw exploitable from the public internet without prior foothold.
The technical mechanism behind this vulnerability relies heavily on social engineering elements, specifically requiring human interaction from a person other than the attacker for successful exploitation. This characteristic aligns with attack patterns where an adversary might craft malicious content or links that appear legitimate to end-users within the organization. When such interactions occur, they can trigger the underlying flaw in the Analytics Server, leading to a complete takeover of Oracle Business Intelligence Enterprise Edition. The ability to achieve full system compromise means the attacker gains control over the application's functionality and potentially its underlying operating environment if further exploitation chains are present. This level of access allows for extensive manipulation of data integrity, unauthorized disclosure of sensitive business intelligence reports, and disruption of availability services essential for daily operations.
From a risk assessment perspective, this vulnerability carries a CVSS 3.1 Base Score of 7.8, which is classified as High severity. The vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) details the specific attributes contributing to this score. Access Vector Local indicates that an attacker must be able to interact directly with the system, such as through a local network connection or compromised endpoint within the same subnet. Low Attack Complexity suggests that exploiting the flaw does not require specialized conditions beyond standard interaction. The absence of required Privileges confirms that no initial login is needed, while the Requirement for User Interaction highlights the social engineering aspect. Crucially, the impacts on Confidentiality, Integrity, and Availability are all rated as High, meaning a successful exploit results in total compromise of these security pillars within the context of the application.
In terms of industry-standard classifications, this vulnerability exhibits characteristics consistent with CWE-20 Improper Input Validation if the flaw stems from processing untrusted data without adequate sanitization, or potentially CWE-79 Cross-site Scripting if the user interaction involves malicious scripts executed in a browser context interacting with the BI server. Furthermore, the requirement for human interaction and subsequent system takeover maps closely to ATT&CK technique T1566 Phishing, specifically sub-techniques involving spearphishing links or attachments that trigger local exploits. The post-exploitation phase where an attacker takes over the application aligns with MITRE ATT&CK tactics such as TA0004 Privilege Escalation and TA0009 Collection if sensitive data is exfiltrated, or TA0005 Defense Evasion if persistence mechanisms are established within the BI environment.
The operational impact of this vulnerability extends beyond simple application downtime. Since Oracle Business Intelligence Enterprise Edition often serves as a central hub for corporate decision-making, compromising it can lead to significant business disruption. Attackers could alter key performance indicators displayed in dashboards, leading to misguided strategic decisions based on falsified data integrity issues. Additionally, the confidentiality breach implies that proprietary market analysis, financial forecasts, and internal metrics accessible through the BI platform could be stolen by competitors or malicious actors. The availability impact ensures that critical reporting services can be rendered inaccessible during periods of peak business activity, causing operational paralysis for departments relying on real-time analytics.
Mitigation strategies must prioritize immediate patching to the latest supported version provided by Oracle, as legacy versions like 8.2.0.0.0 and 12.2.1.4.0 are likely past their extended support phases or have known unpatched risks that newer releases address. For environments where upgrading is not immediately feasible, network segmentation should be enforced to restrict access to the Analytics Server component strictly to authorized administrative IPs and trusted application servers, thereby mitigating the Local Access Vector requirement. Implementing strict input validation controls at any proxy or gateway preceding the BI server can also help filter out malicious payloads before they reach the vulnerable component. Furthermore, security awareness training for employees is critical given the user interaction dependency; users should be educated to recognize suspicious links and attachments that might trigger such exploits. Regular vulnerability scanning focused on identifying unpatched Oracle components within the infrastructure will aid in maintaining a robust defense posture against this specific threat vector.