CVE-2026-71056

HighCVSS 7.7

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Vulnerability in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker can via HTTP gain unauthorized access to critical data or all data accessible in the product. Attacks may impact additional products (scope change).

Risk Assessment

Risk includes confidentiality breach, potentially affecting other products in the environment.

Recommendation

Apply vendor patches for affected versions and monitor HTTP traffic for suspicious activity.

Original NVD description (English source)

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).