This vulnerability in Oracle Business Intelligence Enterprise Edition (version 26.01.0.0.0) affects the Analytics Web Answers component. It allows a high privileged attacker with network access via HTTP to compromise the system, potentially leading to complete takeover of the product. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and strongly recommends applying patches promptly.

Successful exploitation can lead to full compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. The attacker must have high privileges and network access via HTTP. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to mitigate this and other vulnerabilities.