CVE-2026-91597
HighCVSS 8.3Summary
Vulnerability in Oracle Business Intelligence Enterprise Edition (Platform Security component) affecting versions 8.2.0.0.0 and 26.01.0.0.0. A difficult-to-exploit attack from the physical network segment adjacent to the host allows an unauthenticated attacker to take over the system, potentially impacting other products.
Risk Assessment
BI platform takeover may compromise confidentiality, integrity and availability and affect related systems (scope change).
Recommendation
Apply the Oracle patch and restrict access to the network segment where Oracle BI Enterprise Edition runs.
Other vulnerabilities in Oracle Business Intelligence Enterprise Edition
See all- CVE-2026-91557High
Vulnerability in Oracle Business Intelligence Enterprise Edition (BI Foundation component) affecting version 12.2.1.4.0. A difficult-to-exploit local attack allows a low-privileged attacker logged on to the infrastructure to take over the system.
- CVE-2026-91549High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91546High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows an unauthenticated attacker with network access via HTTP to take over the application, though exploitation is difficult. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91545High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) allows an unauthenticated attacker with logon to the infrastructure to take over the application, requiring user interaction. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91539High
Vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows a low-privileged attacker with logon to the infrastructure to take over the application. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91535High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows a low-privileged attacker with network access via HTTP to take over the application. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91534High
Vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) allows an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash (DoS) and unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-87263High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Analytics Server component) affecting versions 8.2.0.0.0 and 26.01.0.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over the system.
- CVE-2026-21976High
Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.
- CVE-2017-10060High
A vulnerability in the Oracle Business Intelligence Enterprise Edition component allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS