This vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 in the BI Platform Security component. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized ability to cause a hang or frequent crash (complete denial of service) and unauthorized read, update, insert, or delete access to some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, with impacts on confidentiality (low), integrity (low), and high impact on availability. The vendor advisory is a general Critical Patch Update advisory for July 2026 listing many products and versions but does not explicitly confirm a patch or fix for this specific vulnerability or affected versions. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory and patch documentation.

Successful exploitation can lead to a complete denial of service by causing the Oracle Business Intelligence Enterprise Edition to hang or crash repeatedly. Additionally, attackers can gain unauthorized read access to some data, as well as unauthorized ability to update, insert, or delete certain accessible data within the product. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has published a Critical Patch Update advisory for July 2026 that includes security patches for multiple products. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 regarding this vulnerability. Therefore, patch status is not yet confirmed — users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to the affected service to trusted users only.