This vulnerability affects Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) in the Platform Security component. It is exploitable remotely over HTTP by an attacker with low privileges, but it is considered difficult to exploit. Successful exploitation can lead to complete compromise of the affected Oracle Business Intelligence Enterprise Edition instance. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes across multiple Oracle products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in full takeover of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, although the attack complexity is high. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this vulnerability. No alternative mitigations or workarounds are specified in the advisory.