CVE-2026-91577 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0 and potentially other supported releases within the Oracle Analytics suite. This security flaw represents a critical weakness in how the application handles authentication and authorization checks for HTTP-based requests. The core technical issue involves an insufficient verification mechanism that allows low-privileged attackers to bypass expected access controls when interacting with the platform over standard network protocols. Because the vulnerability is exploitable via HTTP, it does not require complex setup or physical proximity, making it accessible to remote adversaries who have established a foothold within the same network segment or can reach the service through exposed interfaces. The presence of this flaw indicates that the application fails to properly enforce security policies when processing specific inputs, leading to a breakdown in the intended separation between user roles and data access rights.
From an operational perspective, the impact of this vulnerability is significant due to its potential for scope expansion. While the technical defect originates within Oracle Business Intelligence Enterprise Edition, successful exploitation can lead to broader consequences that affect additional products integrated with or dependent on the BI platform. This scope change implies that attackers may leverage compromised data from the analytics environment to gain unauthorized access to downstream systems, such as data warehouses, reporting tools, or enterprise resource planning modules. The ability of an attacker to compromise these interconnected services amplifies the risk profile beyond a simple isolated incident, potentially leading to lateral movement within the organization's IT infrastructure and increasing the difficulty of containment and remediation efforts for security teams.
The specific impacts resulting from successful exploitation include unauthorized read access to a subset of accessible data as well as unauthorized update, insert, or delete operations against other portions of the database. This dual impact on both confidentiality and integrity highlights the severity of the flaw. Unauthorized read access allows attackers to exfiltrate sensitive business intelligence reports, customer information, or strategic metrics that were intended for higher-privileged users only. Simultaneously, the ability to modify data introduces risks related to data tampering, where critical records can be altered, deleted, or injected with malicious content. This compromises the trustworthiness of analytics outputs and can lead to flawed decision-making processes if corrupted data is consumed by business stakeholders relying on accurate reporting from the platform.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-269 Improper Privilege Management, as it involves a low-privileged user gaining elevated capabilities beyond their assigned role. It also relates to CWE-862 Missing Authorization, where the application fails to verify that the authenticated user has permission for the requested action on specific data resources. From an offensive security perspective, this behavior is consistent with ATT&CK technique T1078 Valid Accounts, as attackers utilize legitimate but low-level credentials to perform unauthorized actions. The CVSS 3.1 base score of 6.4 reflects a medium severity rating driven by the network accessibility and low attack complexity, balanced against the limited availability impact since service disruption is not explicitly mentioned in the primary description.
To mitigate this risk, organizations running Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 must apply the latest security patches provided by Oracle as soon as they are available. Immediate remediation should be prioritized to close the gap that allows unauthorized data manipulation and exfiltration. In addition to patching, administrators should review network segmentation strategies to ensure that BI platform endpoints are not unnecessarily exposed to untrusted networks or public internet zones. Implementing strict access control lists and monitoring for anomalous HTTP requests targeting sensitive API endpoints can provide an additional layer of defense while patches are being deployed. Regular audits of user permissions within the BI environment are also recommended to minimize the blast radius in case a low-privileged account is compromised, ensuring that even if exploitation occurs, the scope of accessible data remains as restricted as possible according to the principle of least privilege.