This vulnerability affects Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0, specifically in the BI Search component. It permits an attacker with low privileges and network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, full unauthorized access to all data accessible by the product, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with low availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability, among others, and strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Business Intelligence Enterprise Edition, unauthorized access to all accessible data, and partial denial of service conditions. This compromises confidentiality, integrity, and availability of the affected system and its data.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers running Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 should apply the relevant security patches from this update without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to mitigate exploitation risks.