CVE-2026-91598 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition, a core part of the Oracle Analytics suite. This security flaw affects specific supported versions including 8.2.0.0.0 and 26.01.0.0.0, indicating that legacy systems as well as certain mid-range releases are susceptible to exploitation. The Majel Mobile Service is designed to facilitate mobile access to business intelligence data, but its implementation contains a critical flaw that allows for unauthorized information disclosure under specific conditions.
The technical nature of this vulnerability centers on an improper access control mechanism within the HTTP interface of the service. An attacker with low privileges and network connectivity can exploit this weakness by sending specially crafted requests over HTTP. The exploitation does not require user interaction or complex social engineering, as it relies solely on network-level access to trigger the flaw. This characteristic aligns with Common Weakness Enumeration category CWE-284, which describes Improper Access Control, specifically where an actor is able to bypass intended restrictions to gain unauthorized privileges.
The operational impact of a successful exploitation is limited in scope but significant for data integrity and confidentiality. The vulnerability results in unauthorized read access to a subset of the Oracle Business Intelligence Enterprise Edition accessible data. This means that while the attacker cannot modify or delete information, nor can they disrupt service availability, they are able to extract sensitive business intelligence reports, dashboards, or underlying datasets that were not intended for their level of clearance. The impact is strictly confined to confidentiality, as indicated by the CVSS 3.1 base score of 4.3 with a vector emphasizing network accessibility and low privilege requirements but no integrity or availability impacts.
From a threat modeling perspective, this vulnerability maps to MITRE ATT&CK techniques related to Data from Information Repositories. Attackers can leverage this flaw as an initial access point for data exfiltration within the internal network environment. The ability to read sensitive reports without authentication bypasses standard security boundaries, potentially leading to competitive intelligence leaks or regulatory compliance violations depending on the nature of the exposed data.
Mitigation strategies should prioritize immediate patching by Oracle if available for the affected versions. In cases where patches are not immediately deployable, organizations should implement network segmentation to restrict HTTP access to the Majel Mobile Service component only from trusted internal subnets. Additionally, deploying Web Application Firewalls with rules specifically targeting known exploitation patterns of this vulnerability can provide an additional layer of defense. Regular auditing of user permissions and ensuring that low-privileged accounts do not have unnecessary access to sensitive BI modules are also critical preventive measures.