A vulnerability exists in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (component: Analytics Web General) that allows an unauthenticated attacker with network access via HTTP to potentially take over the product. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in its September 2026 Critical Security Patch Update.