CVE-2026-91597: Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeove

This vulnerability affects Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) within Oracle Analytics, specifically in the Platform Security component. It is difficult to exploit and requires the attacker to have physical access to the communication segment connected to the hardware where the software runs. The vulnerability allows an unauthenticated attacker to compromise the product, potentially leading to full system takeover. The scope of impact extends beyond this product to other Oracle products. The CVSS 3.1 vector indicates attack vector is adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), and high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Oracle has included fixes for this vulnerability in its October 2026 Critical Patch Update, which contains numerous patches across multiple product families.

Successful exploitation can result in complete compromise of Oracle Business Intelligence Enterprise Edition, including full confidentiality, integrity, and availability loss. The vulnerability's scope change means that other Oracle products may also be significantly impacted by attacks leveraging this flaw. The attack requires physical access to the communication segment, making exploitation difficult but potentially severe.

Oracle has released security patches for this vulnerability as part of the October 2026 Critical Patch Update. Users of affected versions (8.2.0.0.0 and 26.01.0.0.0) should apply the official patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No alternative mitigations or workarounds are specified in the advisory.