CVE-2026-91582 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the BI Search component of Oracle Business Intelligence Enterprise Edition, specifically affecting version 12.2.1.4.0 which is part of the broader Oracle Analytics suite. This security flaw represents a significant risk to organizations relying on this platform for data analytics and reporting, as it exposes a critical entry point that can be leveraged by malicious actors without requiring prior authentication credentials. The nature of this vulnerability allows an attacker who has network access via HTTP to interact with the service in a manner that triggers unintended behavior within the application logic. While the attack vector is remote and does not require user interaction or complex exploitation techniques beyond basic network connectivity, the difficulty associated with exploiting it suggests that successful attacks may rely on specific timing conditions, resource exhaustion strategies, or precise input formatting rather than straightforward code execution flaws.
From a technical perspective, this vulnerability primarily impacts the availability of the Oracle Business Intelligence Enterprise Edition service. The core issue manifests as an ability to cause a partial denial of service, meaning that while the system remains technically operational, its performance degrades significantly enough to render it unusable for legitimate users or specific critical functions. This aligns with Common Weakness Enumeration classifications such as CWE-400 which pertains to uncontrolled resource consumption, where improper handling of requests leads to excessive allocation of CPU cycles, memory, or network bandwidth. The vulnerability does not appear to compromise the confidentiality or integrity of data stored within the system, as indicated by the zero impact on those security pillars in the CVSS scoring model. Instead, it targets the operational continuity of the BI platform, potentially disrupting business intelligence workflows and decision-making processes that depend on real-time or near-real-time data access.
The operational impact of this vulnerability is substantial for enterprises dependent on Oracle Analytics for strategic insights. A partial denial of service can lead to increased latency in report generation, timeouts during dashboard loading, and general instability within the BI environment. For organizations with high availability requirements, even a temporary degradation in performance can have cascading effects on downstream systems that rely on data exports or API integrations from this platform. Although the CVSS 3.1 base score is rated at 3.7 indicating low severity due to the high complexity required for exploitation and the limited scope of impact restricted to availability, the potential for disruption remains a concern. Attackers could potentially use this flaw as part of a larger campaign involving distributed denial-of-service tactics or simply target specific instances where resource constraints are already present, thereby amplifying the effect of the vulnerability through environmental factors rather than technical sophistication alone.
In terms of threat modeling and industry standards, this vulnerability maps to ATT&CK techniques related to Resource Hijacking or Denial of Service, specifically focusing on service disruption without data exfiltration. The attack vector is classified as Network with High complexity and No privileges required, which underscores the importance of network segmentation and access control lists in mitigating exposure. To mitigate these risks, organizations should ensure that their Oracle Business Intelligence Enterprise Edition instances are updated to a patched version provided by Oracle if available for this specific component. Additionally, implementing web application firewalls can help filter out malformed or excessively resource-intensive requests before they reach the BI Search module. Network-level controls such as rate limiting and connection throttling on HTTP traffic directed at port 80 or relevant service ports can also reduce the effectiveness of exploitation attempts by restricting the volume of requests a single source can generate within a given timeframe, thereby preserving system stability against potential abuse.