IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle Business Intelligence Enterprise Edition: Takeover via Analytics Web Administration

CVE-2026-91241Critical 9.1

← All vulnerabilities

Summary

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the Analytics Web Administration component, rated critical with CVSS 9.1. An attacker with network access over HTTP and high privileges can take over the product, and because of the scope change, attacks may also impact other systems. The attack requires administrator-level credentials, so the risk is mainly for installations where the admin interface is reachable from the internet or uses weak or shared admin passwords.

Affected

  • Oracle Business Intelligence Enterprise Edition 8.2.0.0.0
  • Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
  • Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle's August and September 2026 advisories list this release as 26.1.0.0.0; confirm the exact release string on the installed system)

Fixed in

Unknown. Fixes are listed in the Oracle Analytics Patch Availability Document linked from the October 2026 Critical Patch Update advisory. Patches are available only for versions covered by Premier Support or Extended Support.

Workaround

Unknown. No vendor workaround was found. Until patched:

  • Keep the Analytics Web Administration interface off the internet and limit it to an internal admin network or VPN.
  • Reduce accounts with administrator rights and enforce MFA where supported.

Exploitation

  • CISA SSVC: Exploitation none, automatable no, technical impact total.
  • Not listed in CISA KEV at the time of research.
  • No public proof of concept and no reports of exploitation found; absence is not confirmed.
  • Reported by Positive Technologies (PT-2026-119773).

Our recommendation

  • Check whether Business Intelligence Enterprise Edition is installed and record the exact release string.
  • Compare it with the affected versions and apply the Oracle Analytics patch from the October 2026 CPU via My Oracle Support, or plan an upgrade if the release is out of support.
  • Until patched, confirm the admin interface is not reachable from the internet and review admin-access logs for unexpected activity.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:44.

Original description (NVD)

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed