This vulnerability affects the Analytics Actions component of Oracle Business Intelligence Enterprise Edition. It allows an attacker with low privileges and network access via HTTP to compromise the system, potentially gaining unauthorized access to critical data and the ability to modify some data. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this and many other vulnerabilities. The advisory emphasizes the importance of applying patches promptly to prevent exploitation.

Successful exploitation can result in unauthorized access to critical data within Oracle Business Intelligence Enterprise Edition and unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond the immediate product, potentially impacting additional Oracle products.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security updates to prevent exploitation. Patch status is confirmed by the vendor advisory, and no alternative mitigations are indicated.