This vulnerability affects Oracle Business Intelligence Enterprise Edition (component: Analytics Server) in versions 8.2.0.0.0 and 26.01.0.0.0. It permits a low privileged attacker with network access via HTTP to exploit the flaw easily, resulting in potential full compromise of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying patches without delay.

Successful exploitation can lead to complete takeover of Oracle Business Intelligence Enterprise Edition, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt analytics services, and potentially leverage the compromised system for further attacks.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.