Oracle Business Intelligence Enterprise Edition: Improper access control

Summary

Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0 are affected by an access control flaw in the Platform Security component (CWE-284). Oracle and the CNA rate it 8.3 (High) with scope change. An unauthenticated attacker who has access to the physical communication segment of the hardware running OBIEE can take over the application and potentially affect other products. Exploitation is rated difficult, and VulDB scores the issue 5.3, so the severity is not consistent across sources.

Affected

• 8.2.0.0.0
• 26.01.0.0.0
• Version 12.2.1.4.0 is not listed for this CVE. Do not assume it is unaffected without checking Oracle's advisory.

Fixed in

Unknown. Patches are part of Oracle's October 2026 Critical Patch Update (Rev 2, 26 October 2026). Exact patch numbers and fixed version strings are not confirmed.

Workaround

Unknown. Neither the CVE record nor Oracle publishes a workaround. Until patched, restrict which hosts share a network segment with the OBIEE server (this is a recommendation, not vendor guidance).

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, not automatable.
• VulDB: no public exploit or technical details.
• EPSS: 0.0019.
• No reports of in-the-wild exploitation.

Our recommendation

• Check whether OBIEE is deployed and which versions run, including 12.2.1.4.0.
• Apply Oracle's October 2026 Critical Patch Update if you hold a valid support contract; plan an upgrade path for unsupported installs.
• Place the OBIEE server on a segmented network and restrict access from user, guest and IoT devices.
• Monitor the server and its network segment for unusual activity until patched.
• Raise the priority to high if the server shares a flat LAN or holds sensitive reports.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update October 2026 www.oracle.com
• OpenCVE entry CVE-2026-91597 app.opencve.io
• VulDB entry 424420 vuldb.com
• Vulners entry CVE-2026-91597 vulners.com
• Tenable plugin pipeline issue 234554 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:30.