This vulnerability exists in the Platform Security component of Oracle Business Intelligence Enterprise Edition. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to compromise OBIEE, leading to complete takeover of the system. The CVSS 3.1 vector indicates local attack vector with low attack complexity, requiring privileges but no user interaction, and results in high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 CSPU, which includes targeted security fixes for affected products.

Successful exploitation allows an attacker with low privileges on the hosting infrastructure to fully compromise Oracle Business Intelligence Enterprise Edition, affecting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and service disruption within OBIEE.

Oracle has released a fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk. Oracle recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.