CVE-2026-60674

HighCVSS 8.2

Published: 21/07/2026(UTC)Updated: 07/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Vulnerability in Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics) versions 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable, allows an unauthenticated attacker via HTTP to gain unauthorized access to critical data and modify it.

Risk Assessment

Risk of compromising confidentiality and integrity of analytical data, potentially leading to incorrect business decisions.

Recommendation

Apply the Oracle patch for versions 8.2.0.0.0 and 26.01.0.0.0. Restrict access to the HTTP interface.

Other vulnerabilities in Oracle Analytics

CVE-2026-60671High
Vulnerability in Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics) versions 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable, allows an unauthenticated attacker via HTTP to cause hangs or frequent crashes (DOS), as well as unauthorized read and modification of data.

Original NVD description (English source)

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).