This vulnerability affects Oracle Business Intelligence Enterprise Edition (Oracle Analytics) platform security in version 26.01.0.0.0. It allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the system. The attack requires human interaction from a third party and can result in complete takeover of the Oracle Business Intelligence Enterprise Edition environment. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond the initial target. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality, integrity, and availability impacts.

Successful exploitation can lead to full compromise of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products may also be significantly affected. The vulnerability requires local access with valid logon and human interaction, making exploitation more complex but still impactful if successful.

Oracle has released a Critical Security Patch Update (CSPU) in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes staying on actively-supported versions and applying patches without delay. No indication of 'no action required' or 'already mitigated' is present, so patching is the recommended mitigation.