This vulnerability in Oracle Business Intelligence Enterprise Edition's BI Search component allows a low privileged attacker who has logon access to the underlying infrastructure to compromise the product, potentially resulting in complete takeover. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. It has a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity, and availability. Oracle has released security patches as part of its September 2026 Critical Security Patch Update, which includes 673 new security fixes across multiple products including Oracle BI EE. Customers are urged to apply these patches without delay to prevent exploitation.

Successful exploitation can lead to full compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. The attacker requires only low privileged access to the infrastructure where the product runs. No active exploitation in the wild has been reported so far.

Oracle has released patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. No additional vendor mitigation instructions are provided.