CVE-2026-91534
HighCVSS 8.6Summary
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (DoS) and unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
Risk Assessment
An attacker can remotely crash the BI system, causing service unavailability, and modify and read some data, potentially disrupting business operations.
Recommendation
Update Oracle BI Enterprise Edition to the latest version and implement network access restrictions and service availability monitoring.
Other vulnerabilities in Oracle Business Intelligence Enterprise Edition
See all- CVE-2026-91597High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Platform Security component) affecting versions 8.2.0.0.0 and 26.01.0.0.0. A difficult-to-exploit attack from the physical network segment adjacent to the host allows an unauthenticated attacker to take over the system, potentially impacting other products.
- CVE-2026-91557High
Vulnerability in Oracle Business Intelligence Enterprise Edition (BI Foundation component) affecting version 12.2.1.4.0. A difficult-to-exploit local attack allows a low-privileged attacker logged on to the infrastructure to take over the system.
- CVE-2026-91549High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91546High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows an unauthenticated attacker with network access via HTTP to take over the application, though exploitation is difficult. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91545High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91539High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows a low-privileged attacker with logon to the infrastructure to take over the application. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91535High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows a low-privileged attacker with network access via HTTP to take over the application. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-87263High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Analytics Server component) affecting versions 8.2.0.0.0 and 26.01.0.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over the system.
- CVE-2026-21976High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.
- CVE-2017-10060High
A vulnerability in the Oracle Business Intelligence Enterprise Edition component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS