This vulnerability exists in the Installation component of Oracle Business Intelligence Enterprise Edition. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Exploitation can result in complete compromise of the Oracle Business Intelligence Enterprise Edition environment. The vulnerability affects specific versions: 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. The advisory strongly recommends applying these patches promptly to mitigate the risk.

If exploited, this vulnerability allows an attacker with low privileges and logon access to the infrastructure to take over Oracle Business Intelligence Enterprise Edition. This results in high impact on confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Remaining on actively-supported versions and promptly applying Oracle's security patches is critical to prevent exploitation.