This vulnerability in Oracle Business Intelligence Enterprise Edition (BI Platform Security component) permits unauthenticated remote attackers to compromise the system via HTTP network access. Successful exploitation results in unauthorized access to sensitive or all data accessible through Oracle BI Enterprise Edition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction and impacts confidentiality with high severity. Affected versions explicitly include 8.2.0.0.0 and 26.01.0.0.0. The vendor advisory references a Critical Security Patch Update released in August 2026 covering this and many other vulnerabilities, urging customers to apply patches promptly.

Exploitation of this vulnerability can lead to unauthorized disclosure of critical or all data accessible within Oracle Business Intelligence Enterprise Edition. There is no impact on integrity or availability reported. The vulnerability is remotely exploitable without authentication, increasing risk exposure.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to remediate this issue. No indication from the vendor advisory suggests that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory; therefore, applying the official fix is the recommended mitigation.