This vulnerability affects Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 in the Platform Security component. It is exploitable by a high privileged attacker with network access via HTTP, allowing compromise of the product and potentially full takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products, including Oracle Business Intelligence Enterprise Edition.

Successful exploitation allows a high privileged attacker with network access to compromise Oracle Business Intelligence Enterprise Edition, resulting in full takeover of the product. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified.