This vulnerability affects Oracle Business Intelligence Enterprise Edition (component: Analytics Server) in versions 8.2.0.0.0 and 26.01.0.0.0. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the system, resulting in unauthorized access to critical or complete data accessible by the product. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network attack vector with low complexity, no privileges or user interaction required, and a high confidentiality impact. The vulnerability is listed under CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized access to sensitive or all data accessible through Oracle Business Intelligence Enterprise Edition, compromising confidentiality. There is no impact on integrity or availability reported. This could expose critical business intelligence data to attackers without authentication.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication was found that this vulnerability is mitigated without patching or that no action is required.