This vulnerability exists in the Presentation Services component of Oracle Business Intelligence Enterprise Edition. It is exploitable remotely by an attacker with low privileges over the network via SOAP, leading to unauthorized access to sensitive data or full data access within OBIEE. The vulnerability also has scope change implications, potentially impacting additional Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 new security patches across multiple Oracle products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation allows an attacker with network access and low privileges to gain unauthorized access to critical data or complete access to all data accessible through Oracle Business Intelligence Enterprise Edition. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability also has scope change implications, meaning it may affect additional Oracle products beyond OBIEE.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.