What is the CVSS score of CVE-2026-60671?

CVE-2026-60671 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle BI EE are affected by CVE-2026-60671?

Oracle Business Intelligence Platform (versions 8.2.0.0.0 and 26.01.0.0.0) is vulnerable to a critical unauthenticated attack that can crash the system and modify data without credentials.

How to fix or mitigate CVE-2026-60671?

Within 24 hours: Identify all instances of Oracle BI Platform versions 8.2.0.0.0 and 26.01.0.0.0 in your environment and document their network exposure; implement immediate network segmentation to restrict unauthenticated HTTP access to affected BI servers from untrusted networks. Within 7 days: Deploy Web Application Firewall (WAF) rules to monitor and block suspicious requests to the BI Platform, complete a detailed inventory of all affected systems with business criticality assessment, and brief stakeholders on interim risk and mitigation progress. Within 30 days: Contact Oracle Support to confirm patch release timeline, evaluate upgrade paths to patched versions when available, and implement enhanced logging and real-time alerting on BI Platform servers to detect exploitation attempts.

Oracle BI EE CVE-2026-60671

EUVD-2026-47030 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gcqm-x4jm-6jpx

Oracle Authentication Bypass Business Intelligence

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

8.6 HIGH

Oracle confirms easily exploitable unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N); complete DOS drives A:H while data impact is a bounded subset, so C:L/I:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:48 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

AnalysisAI

Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Business Intelligence Enterprise Edition (OBIEE / Oracle Analytics Server) is an enterprise analytics and reporting platform; the affected BI Platform Security component governs authentication, authorization, and session handling for the BI presentation and back-end services. The flaw is reachable over HTTP against the web-facing BI services, and the impact profile - high availability impact with only partial confidentiality and integrity impact - points to a request-handling or resource-consumption defect (e.g., a request that exhausts resources or triggers an unhandled fault) that also exposes a bounded set of data operations. Oracle publishes no CWE for this advisory (CWE: N/A), so the precise weakness class is unstated; the impact profile (A:H, C:L, I:L) is the clearest available signal of root cause.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, the vendor-released fix channel for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch applicable to your OBIEE 8.2.0.0.0 or 26.01.0.0.0 deployment (Oracle ships fixes per-CPU rather than as a standalone tagged version, so identify the specific patch number for your platform from that advisory). Because the input does not name an independently verified fixed build, use the CPU advisory as the source of truth for the exact patch. As compensating controls until patched, restrict network reachability to the BI HTTP endpoints - place the server behind a VPN or restrict source IPs at the load balancer/WAF so only trusted analytics users can reach it (trade-off: breaks broad or public self-service access); and rate-limit or filter anomalous HTTP requests to the BI presentation services to blunt the DOS vector (trade-off: aggressive limits may throttle legitimate heavy report queries). Monitor for repeated service hangs or crashes as an exploitation indicator.