CVE-2026-21976
HighSummary
Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.
Risk Assessment
The risk involves breach of confidentiality and integrity, potentially leading to loss or manipulation of critical business data. The attack requires only low privileges and local logon, increasing the likelihood of exploitation by internal users.
Recommendation
Apply Oracle patches immediately for versions 7.6.0.0.0 and 8.2.0.0.0. Additionally, restrict local access to the infrastructure and monitor activities of low-privileged users.
Other vulnerabilities in Oracle Business Intelligence Enterprise Edition
See all- CVE-2017-10060High
A vulnerability in the Oracle Business Intelligence Enterprise Edition component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
- CVE-2016-3544High
Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 11.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General.
- CVE-2016-3446High
An unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Analytics Web Administration.
- CVE-2026-71122High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Platform Security) version 26.01.0.0.0. A high-privileged attacker with network access via HTTP can exploit this, potentially leading to takeover of the system.
- CVE-2026-71107High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Analytics Server). Affects versions 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable, allows unauthenticated attacker via HTTP to access all data. CVSS 7.5.
- CVE-2026-71099High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Analytics Web Answers). Affects version 26.01.0.0.0. Easily exploitable, allows high-privileged attacker via HTTP to take over system. CVSS 7.2.
- CVE-2026-71098High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Platform Security). Affects version 26.01.0.0.0. Difficult to exploit, allows low-privileged attacker with local access to take over system. CVSS 7.0.
- CVE-2026-71097High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Platform Security). Affects version 26.01.0.0.0. Easily exploitable, allows low-privileged attacker with local access to take over system. CVSS 7.8.
- CVE-2026-71096High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: BI Platform Security) affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker via HTTP, under difficult conditions, can compromise confidentiality and integrity of data, including critical data, and impact other products (scope change).
- CVE-2026-71095High
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: BI Platform Security) affects version 12.2.1.4.0. A low-privileged attacker via HTTP can easily compromise confidentiality, integrity, and availability of data, including critical data, and cause partial denial of service.
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).