This vulnerability in Oracle Business Intelligence Enterprise Edition (version 12.2.1.4.0) allows an attacker with low privileges and network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Business Intelligence Enterprise Edition. It also allows unauthorized access to critical or all accessible data and can cause a partial denial of service. The impact affects confidentiality, integrity, and availability, with confidentiality and integrity impacts rated high and availability impact rated low.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.