This vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized access to sensitive data and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. Oracle has published this vulnerability as part of their August 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for these specific versions in the provided data.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Business Intelligence Enterprise Edition and can cause a partial denial of service. This compromises confidentiality and availability of the affected system.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory references this vulnerability among many others. However, explicit patch availability for the affected versions 8.2.0.0.0 and 26.01.0.0.0 is not confirmed in the provided data. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.