CVE-2026-91557 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Foundation component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0. This security flaw is characterized by a complex exploitation vector that requires specific environmental conditions to be leveraged effectively. While the attack complexity is rated as high, indicating that specialized access patterns or precise timing may be necessary for successful execution, the privilege requirements are relatively low. An attacker does not need administrative privileges on the underlying infrastructure but merely needs valid logon credentials to interact with the system where Oracle Business Intelligence Enterprise Edition is deployed. This distinction highlights a critical risk factor in enterprise environments where user accounts are frequently provisioned across multiple systems, potentially allowing an adversary who has compromised a lower-privileged account to pivot into this specific application layer.
The technical nature of this flaw allows for a complete compromise of the targeted instance upon successful exploitation. The impact assessment indicates that confidentiality, integrity, and availability are all severely affected, resulting in a CVSS 3.1 base score of 7.0 which classifies the vulnerability as high severity. A successful attack enables an attacker to take full control over Oracle Business Intelligence Enterprise Edition. This level of access implies the ability to read sensitive data stored within the analytics platform, modify reports and dashboards to alter business intelligence outputs, or disrupt service availability by crashing processes or consuming system resources excessively. The potential for unauthorized data exfiltration is significant given that BI platforms often aggregate large volumes of organizational data from various sources into centralized repositories.
From a threat modeling perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-78 OS Command Injection if the underlying mechanism involves improper sanitization of inputs leading to system-level execution. In terms of adversary behavior as defined by MITRE ATT&CK, this scenario maps closely to T1078 Valid Accounts, where attackers use legitimate credentials to gain initial access, followed by techniques associated with lateral movement or privilege escalation within the application layer such as T1530 Data from Cloud Storage Object if data is exfiltrated. The requirement for logon access means that traditional perimeter defenses like firewalls may not detect this activity unless endpoint detection and response solutions are actively monitoring process behavior on the server hosting the BI infrastructure.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Oracle has likely released a patch or update addressing this specific flaw in version 12.2.1.4.0, so applying the latest security patches is the primary corrective action. Organizations should verify their current build number against Oracle Critical Patch Update advisories to ensure they are running a patched release. In addition to patching, implementing strict access controls is essential. This includes enforcing multi-factor authentication for all BI users and ensuring that least privilege principles are applied so that only necessary personnel have logon capabilities to the production infrastructure. Network segmentation should also be reviewed to restrict direct internet-facing exposure of the BI server, placing it behind a web application firewall or reverse proxy that can inspect incoming requests for malicious patterns before they reach the vulnerable component. Continuous monitoring of authentication logs and system processes will aid in detecting any attempted exploitation activities early in the kill chain.