This vulnerability exists in the Platform Security component of Oracle Business Intelligence Enterprise Edition. It is exploitable remotely without authentication but is considered difficult to exploit. Successful exploitation can lead to complete takeover of the affected Oracle Business Intelligence Enterprise Edition instance. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has released security patches as part of their September 2026 Critical Security Patch Update to address this and many other vulnerabilities across multiple products.

An unauthenticated attacker with network access via HTTP could exploit this vulnerability to gain full control over Oracle Business Intelligence Enterprise Edition, compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, or service disruption.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these official patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively-supported versions and promptly applying security updates. No additional mitigations are indicated by the vendor advisory.