This vulnerability exists in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially impacting other products as well. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, complete access to all accessible data, and a partial denial of service condition. The CVSS 3.1 base score is 8.9, indicating high severity with impacts on confidentiality, integrity, and availability. Affected versions explicitly include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability along with hundreds of others across multiple product families.

An attacker exploiting this vulnerability can gain unauthorized creation, deletion, or modification access to critical data within Oracle Business Intelligence Enterprise Edition. They may also gain complete access to all accessible data and cause a partial denial of service. This compromises confidentiality, integrity, and availability of the affected system and potentially other related products due to scope change.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.