Oracle Business Intelligence Enterprise Edition: Compromise via Analytics Server flaw

Summary

Oracle Business Intelligence Enterprise Edition, component Analytics Server, versions 8.2.0.0.0 and 12.2.1.4.0 are affected. An unauthenticated attacker who already has logon to the infrastructure where the product runs can compromise it, and a successful attack can lead to takeover of the product. The attack requires a user other than the attacker to interact with it. The CNA record rates the CVSS 3.1 base score at 7.8 (high impact on confidentiality, integrity and availability). The CWE is listed as CWE-601 in the CNA record, while third-party data shows a different CWE, so this still needs checking.

Affected

• Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 (Analytics Server)
• Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Analytics Server)
• Version 26.01.0.0.0: not listed in the CNA record; verify against the Oracle advisory

Fixed in

Unknown. Check the Oracle Critical Patch Update of October 2026 and its Patch Availability Document for Oracle Analytics for the fixed builds.

Workaround

No workaround is documented.

• Limit who can log on to the BI server and its host until patched.

Exploitation

• No known exploitation.
• Not listed in CISA KEV.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept found.

Our recommendation

• Confirm the fixed builds for 8.2.0.0.0 and 12.2.1.4.0 in the October 2026 Oracle advisory and verify the risk matrix for this CVE.
• Check whether BI Publisher runs on the same servers; if so, prioritise CVE-2026-91554, an unauthenticated network attack on BI Publisher.
• Restrict logon and administrative access to BI hosts and keep them off the public internet.
• Apply the patch to all Oracle BI components together, and check the final CWE and CVSS in NVD.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update October 2026 www.oracle.com
• Oracle Critical Patch Update September 2026 (Patch Availability Document reference) www.oracle.com
• Vulners CVE record vulners.com
• OpenCVE CVE record app.opencve.io
• VulDB CVE record vuldb.com
• Strix CVE record www.strix.ai
• Vulners CVE-2026-91554 (related BI Publisher flaw) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:10.