CVE-2026-91607 in Business Intelligence Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Analytics Server component of Oracle Business Intelligence Enterprise Edition, a core part of the Oracle Analytics suite used for data visualization and reporting. This security flaw affects specific legacy and current versions, notably 8.2.0.0.0 through to 26.01.0.0. The nature of this vulnerability is characterized by its ease of exploitation, allowing an attacker with low privileges who has network access via the HTTP protocol to compromise the integrity of the system. Unlike high-severity vulnerabilities that might allow for remote code execution or complete system takeover, this specific flaw primarily impacts confidentiality rather than availability or integrity in a broad sense. The attack vector is classified as Network-based with Low complexity and requires no user interaction, indicating that an attacker can exploit this issue remotely without needing to trick a legitimate user into performing any actions.
From a technical perspective, the vulnerability enables unauthorized read access to a subset of data accessible within Oracle Business Intelligence Enterprise Edition. This means that while the attacker cannot modify or delete existing records nor execute arbitrary code on the server, they are able to extract sensitive information that should be restricted based on role-based access controls. The scope remains unchanged as the privilege escalation is limited to reading data rather than altering system configurations or gaining higher-level administrative privileges. Consequently, the impact is strictly confined to the confidentiality of specific datasets within the business intelligence environment. This type of flaw often stems from improper implementation of authentication checks or insufficient validation of user permissions when processing HTTP requests directed at sensitive endpoints within the analytics server architecture.
The operational impact of this vulnerability centers on data leakage and potential compliance violations. Since Oracle Business Intelligence Enterprise Edition is typically used to store, process, and display critical business metrics, customer information, financial reports, or strategic plans, unauthorized access can lead to significant competitive disadvantage or regulatory penalties under frameworks such as GDPR, HIPAA, or SOX depending on the nature of the exposed data. An attacker could potentially aggregate this read-accessible data over time to build a comprehensive profile of organizational operations without triggering immediate alarms associated with more destructive attacks like ransomware deployment or database corruption. The CVSS 3.1 base score of 4.3 reflects this medium-level risk, emphasizing that while the attack is straightforward and remote, the direct consequence is limited to partial confidentiality loss rather than total system compromise.
In terms of industry standard classifications, this vulnerability aligns with CWE-285 Improper Authorization or potentially CWE-601 URL Redirection to Untrusted Site if the access control bypass involves redirect mechanisms, though it most closely resembles issues related to broken access controls where insufficient checks allow low-privileged users to view resources they should not. Within the MITRE ATT&CK framework, this behavior corresponds to techniques under Data from Information Repositories or potentially T1078 Valid Accounts if the attacker leverages stolen credentials, but fundamentally it represents a failure in enforcing least privilege principles during data retrieval operations. Security teams should map this vulnerability to their internal risk registers as an exposure of sensitive information via network services.
Mitigation strategies must focus on immediate patching and access control hardening. Oracle has likely released patches or updates addressing the specific flaw in the Analytics Server component; therefore, applying the latest security updates for all supported versions is the primary remediation step. For environments where patching cannot be immediately performed due to operational constraints, network-level controls should be implemented. This includes restricting HTTP access to the analytics server only from trusted IP ranges using firewalls or web application firewalls that can inspect and filter malicious requests. Additionally, enforcing strict role-based access control policies ensures that even if an attacker gains low-privileged access, their ability to query sensitive datasets is minimized by design. Regular auditing of user permissions and reviewing logs for unusual data retrieval patterns can also help in detecting potential exploitation attempts before significant damage occurs.