CVE-2026-91588 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the BI Search component of Oracle Business Intelligence Enterprise Edition, a critical module responsible for indexing and retrieving data from various sources to support analytical queries. This flaw affects specific legacy versions including 8.2.0.0.0 and 12.2.1.4.0, indicating that older deployments or those with delayed patching cycles are at significant risk. The vulnerability is classified as a high-severity integrity issue with a CVSS 3.1 base score of 6.5, primarily driven by its potential for unauthorized modification of critical data despite requiring user interaction to exploit.
Technically, the flaw allows an unauthenticated attacker who has network access via HTTP to compromise the system. The attack vector is remote and requires low complexity, meaning that standard web-based exploitation techniques can be employed without specialized tools or deep knowledge of the target environment. However, a critical constraint in this vulnerability model is the requirement for human interaction from a person other than the attacker. This suggests that the exploit likely involves social engineering tactics where an unsuspecting user must perform an action, such as clicking a malicious link or opening a crafted document, which triggers the vulnerable code path within the BI Search functionality.
The operational impact of this vulnerability is severe regarding data integrity. Successful exploitation enables unauthorized creation, deletion, or modification of access to critical data stored within Oracle Business Intelligence Enterprise Edition. This could lead to the alteration of analytical reports, manipulation of underlying datasets used for business decision-making, or complete removal of sensitive information. Since BI systems often serve as a single source of truth for organizational metrics, compromising their integrity can have cascading effects on strategic planning and operational oversight. The vulnerability does not currently impact confidentiality or availability according to the provided CVSS vector, meaning data is not directly exfiltrated nor is service disrupted in this specific scenario, but the trustworthiness of the information presented by the system is fundamentally broken.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting if it involves script injection, or potentially CWE-200 Exposure of Sensitive Information to an Unauthorized Actor depending on how the search function mishandles input. In terms of MITRE ATT&CK framework tactics, this falls under Initial Access due to the need for user interaction and Execution if the vulnerability allows arbitrary code execution through the BI engine. The requirement for human interaction places it in categories such as Spearphishing Attachment or Spearphishing Link within the adversary's kill chain.
Mitigation strategies should prioritize immediate patching of all affected Oracle Business Intelligence Enterprise Edition instances to versions that include security fixes for this specific flaw. Organizations must verify their current version against the supported list and apply the latest critical patch updates provided by Oracle. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls should be configured to detect and block suspicious patterns associated with BI Search exploitation attempts. Additionally, implementing strict access controls for HTTP endpoints serving the BI interface can reduce the attack surface. User awareness training is also essential given the social engineering aspect of this vulnerability; employees should be educated on recognizing phishing attempts that might lead them to interact with malicious content targeting Oracle applications. Regular audits of data integrity within the BI system are recommended to detect any unauthorized modifications resulting from past or ongoing exploitation attempts.