This vulnerability exists in the Platform Security component of Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. It is easily exploitable remotely by an attacker with low privileges and network access over HTTP. Successful exploitation results in complete compromise of the Oracle Business Intelligence Enterprise Edition environment, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.9). The vulnerability also has potential to impact other Oracle products due to scope change. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to full takeover of Oracle Business Intelligence Enterprise Edition, compromising confidentiality, integrity, and availability of the system. The scope of impact may extend to additional Oracle products. The CVSS 3.1 score of 9.9 reflects critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigations are specified beyond applying the official patch.