CVE-2026-91241
CriticalCVSS 9.1Summary
Vulnerability in Oracle Business Intelligence Enterprise Edition (Analytics Web Administration component) affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A high-privileged attacker with HTTP network access can take over the product, and attacks may significantly impact additional products (scope change).
Risk Assessment
Potential full takeover of Oracle Business Intelligence Enterprise Edition by a high-privileged attacker, with possible impact on related systems.
Recommendation
Update Oracle Business Intelligence Enterprise Edition to a patched version and restrict network access to the Analytics Web Administration component.
Other vulnerabilities in Oracle Business Intelligence Enterprise Edition
See all- CVE-2026-91597High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Platform Security component) affecting versions 8.2.0.0.0 and 26.01.0.0.0. A difficult-to-exploit attack from the physical network segment adjacent to the host allows an unauthenticated attacker to take over the system, potentially impacting other products.
- CVE-2026-91557High
Vulnerability in Oracle Business Intelligence Enterprise Edition (BI Foundation component) affecting version 12.2.1.4.0. A difficult-to-exploit local attack allows a low-privileged attacker logged on to the infrastructure to take over the system.
- CVE-2026-91549High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91546High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows an unauthenticated attacker with network access via HTTP to take over the application, though exploitation is difficult. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91545High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91539High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows a low-privileged attacker with logon to the infrastructure to take over the application. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91535High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows a low-privileged attacker with network access via HTTP to take over the application. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91534High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (DoS) and unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-21976High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.
- CVE-2017-10060High
A vulnerability in the Oracle Business Intelligence Enterprise Edition component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS