Oracle Business Intelligence CVE-2025-53049

Exploitation requires the attacker to already possess high-privileged (administrator-level) authenticated access to the Oracle Business Intelligence Enterprise Edition 'Analytics Web Administration' component, reachable over HTTP, on affected versions 7.6.0.0.0 or 8.2.0.0.0. It additionally requires human interaction from a different privileged person (UI:R) - the victim must view or act on attacker-supplied content - so it cannot be triggered by the attacker alone. Limiting factors that reduce realistic risk: the PR:H requirement (no anonymous or low-privilege path) and the mandatory victim interaction; the strong impact comes from the scope change (S:C), which allows compromise to extend beyond BI EE to additional connected products.

This is a high-CVSS (8.4) flaw whose real-world priority is materially lower than the headline score. The CVSS vector itself tempers the risk: AV:N/AC:L make it network-reachable and technically easy, but PR:H means the attacker must ALREADY hold high (administrative) privileges on Oracle BI EE, and UI:R means a separate victim must interact - two significant gating factors. The scope change (S:C) with full C:H/I:H/A:H and 'takeover' plus 'significantly impact additional products' is what drives the score up. The corroborating exploitation signals are all LOW: EPSS is 0.36% (27th percentile), the vulnerability is NOT in CISA KEV, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: exploitation=none, automatable=no (requires human interaction and pre-existing high privilege), technical impact=total. Net: a genuinely serious impact ceiling but a high exploitation barrier, so this is a patch-in-normal-cycle item for most operators rather than an emergency, UNLESS the environment grants BI admin rights broadly or faces insider/credential-theft threats. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' directly contradicts the CVSS metric PR:H (a true auth bypass would be PR:N); treat the 'Authentication Bypass' label as unreliable and favor the vendor CVSS vector.

An attacker who already holds a high-privileged (administrator-level) account on Oracle BI EE abuses the Analytics Web Administration component to plant a crafted payload, then lures another privileged user into viewing it over HTTP. When that victim interacts, the payload executes in their context, escalating into full compromise of the BI EE instance and, via the scope change, impacting additional connected products. No public exploit code is referenced for this CVE at time of analysis.