This vulnerability affects Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0, specifically in the Platform Security component. An attacker with low privileges but with logon access to the infrastructure where the product runs can exploit this vulnerability to compromise and take over the product. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products. The vendor strongly recommends applying the patches promptly to mitigate this and other vulnerabilities.

Successful exploitation can lead to full compromise and takeover of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. The attacker must have low privileged logon access to the infrastructure, and the attack complexity is high, making exploitation difficult but possible. There are no known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to mitigate this vulnerability. Staying on actively supported versions and promptly applying Oracle patches is critical. Patch status is confirmed by the vendor advisory linked. No alternative mitigations or workarounds are specified.