This vulnerability exists in the Platform Security component of Oracle Business Intelligence Enterprise Edition. It is exploitable by an attacker with high privileges and network access via HTTP, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for affected Oracle products.

Successful exploitation can lead to complete compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends staying on actively-supported versions and applying patches without delay to prevent exploitation. No indication of alternative mitigations or 'no action required' status is provided.