This vulnerability affects Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 in the Presentation Services component. A low privileged attacker who has logon access to the infrastructure where the product runs can exploit this vulnerability, but exploitation requires human interaction from someone other than the attacker. Successful exploitation can result in full compromise of the Oracle Business Intelligence Enterprise Edition environment. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability allows an attacker with low privileges and local access to the infrastructure to take over the Oracle Business Intelligence Enterprise Edition system. This includes full compromise affecting confidentiality, integrity, and availability of the affected system. However, exploitation requires human interaction from a user other than the attacker, which may limit automated exploitation.

Oracle has released security patches as part of its Critical Security Patch Update (CSPU) in August 2026, which address this vulnerability among many others. Oracle strongly recommends applying the available patches promptly to mitigate this vulnerability. Customers should remain on actively supported versions and apply security patches without delay. No indication was given that the vulnerability is already mitigated or requires no action.