This vulnerability exists in the Machine Learning component of Oracle Business Intelligence Enterprise Edition. It is exploitable by an attacker with low privileges who has logon access to the underlying infrastructure where the product runs. Successful exploitation can lead to complete compromise of the Oracle Business Intelligence Enterprise Edition environment. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has released patches as part of their September 2026 Critical Security Patch Update to remediate this issue.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to fully compromise Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. This could result in unauthorized access, data manipulation, and service disruption within the affected environment.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation.