This vulnerability affects Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0, specifically in the Platform Security component. It is difficult to exploit and requires the attacker to have low privilege logon access to the underlying infrastructure. Successful exploitation can lead to full compromise of the Oracle Business Intelligence Enterprise Edition instance. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

If exploited, this vulnerability allows an attacker with low privileged access to the infrastructure to take over the Oracle Business Intelligence Enterprise Edition, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, and service disruption.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle emphasizes staying on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.