This vulnerability exists in the BI Search component of Oracle Business Intelligence Enterprise Edition. It is exploitable remotely over the network via HTTP by an attacker with low privileges, though it is considered difficult to exploit. Successful exploitation can lead to full takeover of the Oracle BI EE system, impacting confidentiality, integrity, and availability. The vulnerability affects specific versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle has addressed this issue in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities across Oracle products.

If exploited, this vulnerability can result in complete compromise of Oracle Business Intelligence Enterprise Edition, allowing an attacker to gain control over the system and potentially access or manipulate sensitive data. The CVSS score reflects high impact on confidentiality, integrity, and availability. No active exploitation has been reported, but the risk remains significant due to the potential for full system takeover.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are specified in the advisory.