This vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product. Exploitation requires user interaction from a third party. The impact includes full confidentiality, integrity, and availability compromise of the affected product. The affected versions explicitly are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's advisory indicates this vulnerability is addressed in their September 2026 Critical Security Patch Update, which contains targeted fixes for this and other vulnerabilities across multiple Oracle products. The vendor strongly urges customers to apply these patches promptly to mitigate risk.

Successful exploitation can lead to complete takeover of Oracle Business Intelligence Enterprise Edition, affecting confidentiality, integrity, and availability of the system. The vulnerability requires that the attacker has logon access to the infrastructure and that a user other than the attacker performs some interaction, which may limit remote exploitation scenarios. No active exploits have been reported so far.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. Since this is not a cloud service, remediation depends on customer patching. Patch status is confirmed by the vendor advisory.