CVE-2026-71096 is a vulnerability in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition that is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability impacts confidentiality and integrity, potentially allowing unauthorized creation, deletion, or modification of critical data. It affects specific versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 other security patches. Oracle advises customers to remain on actively supported versions and apply patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Business Intelligence Enterprise Edition. It compromises confidentiality and integrity, potentially allowing attackers to gain complete access to all data accessible by the product. The vulnerability also has scope to impact additional Oracle products beyond OBIEE. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively supported product versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.