This vulnerability exists in the Platform Security component of Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where OBIEE runs. Successful exploitation can lead to a complete compromise of OBIEE, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability among 673 security patches across multiple products.

An attacker with low privileges and logon access to the infrastructure hosting Oracle Business Intelligence Enterprise Edition can exploit this vulnerability to fully compromise the OBIEE environment. This includes unauthorized access to sensitive data (confidentiality), modification or destruction of data or system components (integrity), and disruption of service (availability). The impact is high severity as reflected by the CVSS score of 7.8.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigations are specified beyond applying the official patch.