This vulnerability affects Oracle Business Intelligence Enterprise Edition, specifically versions 8.2.0.0.0 and 26.01.0.0.0. It allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the Oracle BI Enterprise Edition environment. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and privileges but results in high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which contains numerous fixes across many products including Oracle BI Enterprise Edition. Customers are strongly advised to apply the relevant patches promptly.

An attacker with low privileged logon access to the infrastructure hosting Oracle Business Intelligence Enterprise Edition can exploit this vulnerability to fully compromise the product. This includes complete takeover, affecting confidentiality, integrity, and availability of the system. The impact is rated high with a CVSS score of 7.8.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Business Intelligence Enterprise Edition without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via the vendor advisory.