This vulnerability affects Oracle Business Intelligence Enterprise Edition (BI Platform Security component) in versions 8.2.0.0.0 and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the attack is network-based, requires no privileges or user interaction, and impacts confidentiality with a high severity score of 7.5. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which includes 673 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle Business Intelligence Enterprise Edition. The attacker does not require authentication or user interaction, making the vulnerability easily exploitable over the network via HTTP. The impact is limited to confidentiality; integrity and availability are not affected according to the CVSS vector.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should promptly apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the vendor advisory.