This vulnerability affects Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 in the Platform Security component. It requires the attacker to have low privileged logon access to the infrastructure hosting the product. The vulnerability is difficult to exploit but can result in complete compromise of the Oracle Business Intelligence Enterprise Edition environment. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of their August 2026 Critical Security Patch Update advisory but no explicit patch link or fixed version is provided in the input data.

If exploited, an attacker with low privileged access to the infrastructure can take over Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. This could allow unauthorized access to sensitive data and disruption of business intelligence services.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch link or fixed version is provided in the input data, customers should refer to the Oracle August 2026 Critical Security Patch Update advisory for patch availability and installation instructions. Maintaining actively-supported versions and timely patch application is critical to mitigate this vulnerability.