Oracle Business Intelligence Enterprise Edition: Authentication bypass leading to takeover

Summary

Oracle Business Intelligence Enterprise Edition (Analytics Server component) contains a vulnerability in its authentication handling, classified as CWE-287 (Improper Authentication). A remote attacker with network access over HTTP and a low-privilege account can exploit it without user interaction. Successful exploitation can lead to a complete takeover of the BI installation with high impact on confidentiality, integrity and availability.

Affected

• Oracle Business Intelligence Enterprise Edition, Analytics Server component: versions 8.2.0.0.0 and 26.01.0.0.0 (per CVE record)
• Whether version 12.2.1.4.0 is affected is unknown; verify in Oracle's October 2026 risk matrix.

Fixed in

Unknown. No patch number or fixed build was found in the available sources; check Oracle's October 2026 Critical Patch Update advisory.

Workaround

None documented by Oracle in the available sources.

• Interim measures (own assessment, not vendor guidance): restrict HTTP access to BI endpoints to internal networks or VPN.

Exploitation

• No evidence of exploitation known at the time of research; Oracle's advisory does not state exploitation.
• Not listed in CISA KEV as of 21 October 2026 (per secondary source).
• No confirmed public proof-of-concept code.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS was low (0.00389) at the time of the vulners record.

Our recommendation

• Inventory all Oracle BI EE installations and record exact versions, including any 12.2.1.4.0 instances.
• Check whether each installation is reachable from the internet and restrict access to internal networks or VPN.
• Apply the October 2026 patch for each affected version, or plan an upgrade if the version is out of support.
• Review accounts with low-privilege access and monitor web and authentication logs for unusual BI activity.
• Re-check CISA KEV and Oracle advisories regularly; the next Oracle security patch dates are 17 November and 15 December 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Security Alert October 2026 CPU www.oracle.com
• Oracle Blog: October 2026 Critical Patch Update released blogs.oracle.com
• NVD record via Vulners vulners.com
• Oracle Security Alert September 2026 CPU www.oracle.com
• Brandefense: Oracle October 2026 CPU brandefense.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:43.