This vulnerability exists in the Presentation Services component of Oracle Business Intelligence Enterprise Edition. It is difficult to exploit but allows a low privileged attacker with network access through SOAP to compromise the system, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities across multiple Oracle products.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. Oracle recommends staying on actively supported versions and promptly applying all relevant security updates. No alternative mitigations or workarounds are specified in the advisory.