This vulnerability exists in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. It is difficult to exploit but allows a low privileged attacker with network access via SOAP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying the patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. The vulnerability requires network access via SOAP and low privileges but is rated as difficult to exploit. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Users should apply the official patches provided by Oracle promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified by the vendor advisory.