CVE-2026-91576 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Server component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0 and potentially other supported releases in that lineage. This security flaw represents a significant risk to organizations relying on this platform for enterprise data analytics and reporting. The core issue stems from an improper access control mechanism within the HTTP interface of the Analytics Server. Unlike vulnerabilities requiring complex exploitation chains or high-privilege initial footholds, this defect allows for straightforward exploitation by attackers who possess only low-level user privileges. This lowers the barrier to entry significantly, as it does not require authentication bypasses at a system level or physical access, but rather relies on standard network connectivity and basic account credentials that might be easily obtained through phishing or credential stuffing attacks.
From a technical perspective, the vulnerability enables an attacker with network access via HTTP to compromise the integrity of the Oracle Business Intelligence Enterprise Edition environment. The flaw likely involves insufficient verification of user permissions when processing specific requests directed at sensitive endpoints within the Analytics Server architecture. Because the attack vector is remote and requires low complexity, automated scanning tools or opportunistic attackers can readily identify and exploit this weakness against vulnerable instances exposed to internal networks or the public internet if not properly segmented. The absence of a requirement for user interaction further simplifies the exploitation process, allowing for silent data exfiltration without alerting system administrators through suspicious UI interactions.
The operational impact of successfully exploiting this vulnerability is severe, primarily centered on unauthorized access to critical organizational data. As indicated by the CVSS 3.1 base score of 6.5 with a high confidentiality impact, an attacker can gain complete access to all Oracle Business Intelligence Enterprise Edition accessible data. This means that sensitive business intelligence reports, financial projections, customer lists, and proprietary analytics models could be viewed, copied, or exported without authorization. While the integrity and availability impacts are listed as none in this specific vector description, the loss of confidentiality alone poses a substantial threat to competitive advantage, regulatory compliance, and corporate reputation. The exposure of such data can lead to significant financial losses and legal liabilities depending on the nature of the information compromised.
This vulnerability aligns with CWE-284, Improper Access Control, as it involves a failure in the system's ability to restrict actions or access based on user identity and privileges. Furthermore, from an adversary perspective, this flaw facilitates ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to move laterally within a network and access resources that should be restricted. The exploitation of this vulnerability allows for data exfiltration via standard protocols, mapping closely to ATT&CK tactic TA0010, Exfiltration, specifically techniques involving application layer protocols like HTTP or HTTPS if the connection is encrypted but the underlying logic remains flawed.
To mitigate this risk, organizations must ensure that Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 and related versions are updated to the latest patch level provided by Oracle Security Alerts. It is critical to apply all relevant security patches promptly as they become available through official Oracle channels. Additionally, implementing strict network segmentation can limit exposure; ensuring that Analytics Server instances are not directly accessible from untrusted networks reduces the attack surface significantly. Access controls should be reviewed and hardened, adhering to the principle of least privilege by ensuring users have only the minimum permissions necessary for their roles. Regular auditing of user access rights and monitoring for anomalous data retrieval patterns can also help in detecting potential exploitation attempts early.