EUVD-2026-47030
GHSA-gcqm-x4jm-6jpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OBIEE HTTP endpoint over network
-
DeliverySend crafted request to BI Platform Security service
-
ExploitTrigger unhandled fault or resource exhaustion
-
ExecutionHang or repeatedly crash server (complete DOS)
-
ImpactLimited unauthorized read/insert/update/delete of BI data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Business Intelligence Enterprise Edition, per the CVSS vector AV:N/AC:L/PR:N/UI:N (unauthenticated, no user interaction, low complexity). The only real limiting factor is network reachability of the OBIEE HTTP interface: the attacker must be able to send HTTP requests to the BI services, so deployments that are internally segmented, VPN-gated, or IP-restricted materially reduce exposure. Affected deployments are limited to supported versions 8.2.0.0.0 and 26.01.0.0.0; the description names no feature toggle or non-default configuration as a prerequisite. |
| Impact | The signals converge on a genuinely exploitable, network-facing issue with a DoS-dominant impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H confirms unauthenticated, low-complexity, remote exploitation with no user interaction - Oracle explicitly calls it 'easily exploitable' - and the 8.6 score is driven primarily by A:H (complete DOS), with only Low confidentiality and Low integrity impact. No EPSS score is provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code. Practical priority is high for internet-exposed or business-critical BI deployments because an unauthenticated attacker can take the service offline, but the data-exposure and tampering impact is limited ('a subset' / 'some' of accessible data), making this more an availability/integrity concern than a full confidentiality breach. Missing data: no EPSS, no SSVC decision, and no CWE - treat the tampering scope as bounded but unspecified. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the OBIEE HTTP interface sends a crafted request to the BI Platform Security-facing service, causing the server to hang or repeatedly crash and rendering analytics unavailable to all users (complete DOS). The same access path also permits limited unauthorized reads and data modifications against a subset of BI-accessible data. Exploitation requires only network access with low attack complexity and no credentials; no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Oracle Critical Patch Update of July 2026, the vendor-released fix channel for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch applicable to your OBIEE 8.2.0.0.0 or 26.01.0.0.0 deployment (Oracle ships fixes per-CPU rather than as a standalone tagged version, so identify the specific patch number for your platform from that advisory). Because the input does not name an independently verified fixed build, use the CPU advisory as the source of truth for the exact patch. As compensating controls until patched, restrict network reachability to the BI HTTP endpoints - place the server behind a VPN or restrict source IPs at the load balancer/WAF so only trusted analytics users can reach it (trade-off: breaks broad or public self-service access); and rate-limit or filter anomalous HTTP requests to the BI presentation services to blunt the DOS vector (trade-off: aggressive limits may throttle legitimate heavy report queries). Monitor for repeated service hangs or crashes as an exploitation indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Business Intelligence Enterprise Edition (OBIEE / Oracle Analytics Server) is an enterprise analytics and reporting platform; the affected BI Platform Security component governs authentication, authorization, and session handling for the BI presentation and back-end services. The flaw is reachable over HTTP against the web-facing BI services, and the impact profile - high availability impact with only partial confidentiality and integrity impact - points to a request-handling or resource-consumption defect (e.g., a request that exhausts resources or triggers an unhandled fault) that also exposes a bounded set of data operations. Oracle publishes no CWE for this advisory (CWE: N/A), so the precise weakness class is unstated; the impact profile (A:H, C:L, I:L) is the clearest available signal of root cause.
Know when Business Intelligence gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Oracle confirms easily exploitable unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N); complete DOS drives A:H while data impact is a bounded subset, so C:L/I:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
Executive ViewAI
Oracle Business Intelligence Platform (versions 8.2.0.0.0 and 26.01.0.0.0) is vulnerable to a critical unauthenticated attack that can crash the system and modify data without credentials. While no public exploit code has been identified, the high severity rating and ease of exploitation create urgent risk to any organization using affected versions. Immediate action is required to limit exposure while Oracle develops a patch.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network segmentation to restrict HTTP access to BI Platform servers from untrusted networks, (2) Web Application Firewall (WAF) deployment configured to detect and block malicious requests targeting BI Platform endpoints, (3) rate limiting and connection throttling on BI endpoints to reduce denial-of-service impact, (4) enhanced monitoring and alerting for unauthorized data access attempts on BI databases, and (5) regular backup and rapid recovery procedures for BI data and configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Business Intelligence
View allApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Rated cri
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the in
Exploit-DB