IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle Business Intelligence Enterprise Edition: Missing authentication in Analytics Web General

CVE-2026-91534High 8.6

← All vulnerabilities

Summary

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a missing authentication flaw in the Analytics Web General component. An unauthenticated attacker with network access via HTTP can exploit it with low complexity. Successful attacks can cause a repeatable crash or hang of the service, and allow limited read and modification of accessible data (CVSS 3.1 base score 8.6).

Affected

  • Oracle Business Intelligence Enterprise Edition 8.2.0.0.0
  • Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
  • Oracle Business Intelligence Enterprise Edition 26.01.0.0.0

Fixed in

Unknown. Oracle released fixes in the October 2026 Critical Patch Update (published 20 October 2026); the patch numbers for each release must be confirmed in the Oracle advisory or on My Oracle Support.

Workaround

  • No vendor workaround known.
  • Until patching, restrict network access to the BI EE web interface (no direct internet exposure; use VPN or a reverse proxy with access control).

Exploitation

  • Not listed in CISA KEV. CISA SSVC lists exploitation as none and automatable as yes.
  • No public proof of concept found at time of research.
  • Waratek reports no awareness of public exploitation of vulnerabilities fixed in the October CPU as of publication.

Our recommendation

  • Identify all BI EE instances, including legacy 8.2 and 12.2.1.4 installations.
  • Check whether they are reachable from the internet and restrict access if not required.
  • Apply the October 2026 Oracle Critical Patch Update for your release.
  • Review web server logs for unusual requests since 20 October 2026.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:26.

Original description (NVD)

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed