CVE-2026-60671
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics) versions 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable, allows an unauthenticated attacker via HTTP to cause hangs or frequent crashes (DOS), as well as unauthorized read and modification of data.
Risk Assessment
Risk of BI system downtime and compromise of data confidentiality and integrity, potentially disrupting reporting and analytics.
Recommendation
Apply the Oracle patch for versions 8.2.0.0.0 and 26.01.0.0.0. Implement availability monitoring and restrict network access.
Other vulnerabilities in Oracle Analytics
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).