This vulnerability in Oracle Business Intelligence Enterprise Edition's BI Search component allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible through Oracle Business Intelligence Enterprise Edition. The confidentiality impact is high, while integrity and availability impacts are not affected. The vulnerability's scope change means it may affect additional Oracle products beyond the initially targeted component.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.