CVE-2026-91597 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/22/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Platform Security component of Oracle Business Intelligence Enterprise Edition, a critical module responsible for managing authentication and authorization mechanisms across supported versions including 8.2.0.0.0 through 26.01.0.0. This flaw represents a significant security deficiency that allows an unauthenticated attacker to compromise the integrity and availability of the system under specific network conditions. The nature of this vulnerability is characterized by its difficulty to exploit, which serves as a natural barrier against casual or automated attacks but does not eliminate the risk for determined adversaries with physical access capabilities.
The core technical flaw enables unauthorized takeover of the Oracle Business Intelligence Enterprise Edition instance when an attacker gains access to the physical communication segment attached to the hardware where the application executes. This requirement for local network access means that the attack vector is classified as adjacent, rather than remote or local. An adversary must be physically connected to the same network segment as the target server, such as a switched LAN environment, to attempt exploitation. Once on this segment, the attacker can leverage the vulnerability in the security handling logic to bypass authentication controls and gain administrative privileges over the BI platform.
The operational impact of a successful exploit is severe, resulting in complete compromise of the Oracle Business Intelligence Enterprise Edition system. This includes full control over data confidentiality, integrity, and availability within the scope of that specific application instance. However, due to potential integration points with other enterprise systems such as databases, identity providers, or reporting services, the impact may extend beyond the BI platform itself, leading to a broader scope change where additional products are affected by lateral movement or credential reuse attacks facilitated by the initial compromise. The high severity is reflected in the CVSS 3.1 base score of 8.3, indicating critical risk levels for confidentiality, integrity, and availability impacts when exploited under these specific conditions.
From an industry standards perspective, this vulnerability aligns with CWE-287 Improper Authentication, as it allows unauthenticated access to a privileged function or resource. Additionally, the requirement for physical network segment access maps to ATT&CK technique T1046 Network Service Discovery combined with lateral movement tactics that rely on local network positioning rather than remote exploitation vectors like web application attacks. The difficulty of exploitation suggests that while automated tools may fail, manual exploitation by a skilled attacker is feasible given the necessary proximity and context.
Mitigation strategies must focus on both technical controls and physical security measures. Since the attack vector requires access to the physical communication segment, restricting physical access to server rooms and network infrastructure is paramount. Network segmentation should be implemented to isolate critical BI servers from general user networks using VLANs or firewalls that limit adjacency-based attacks. Additionally, deploying intrusion detection systems capable of identifying anomalous authentication attempts on local segments can provide early warning indicators. Oracle has likely released patches for the affected versions; applying these updates promptly is essential to remediate the underlying code flaw in the Platform Security component. Organizations should also enforce strict access controls and monitor logs for any signs of unauthorized administrative activity, ensuring that even if physical security is breached, logical defenses remain robust against exploitation attempts.