Oracle BI EE CVE-2026-60674

Exploitation requires network HTTP(S) access to an Oracle Business Intelligence Enterprise Edition instance running the affected 8.2.0.0.0 or 26.01.0.0.0 builds with the BI Platform Security component reachable - i.e. an exposed OBIEE presentation/analytics endpoint. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special client-side conditions are needed against default configurations, matching the reporter's Authentication Bypass tag. The primary limiting factor is reachability: instances confined to internal networks, behind VPN, or IP-restricted are not remotely exploitable by external attackers, and organizations already on the July 2026 CPU are not affected.

The signals are largely consistent and point to genuine priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the reporter's 'Authentication Bypass' tag reinforces the PR:N reading. Confidentiality impact is High (full read of BI-accessible data) while Integrity is only Low (partial writes) and Availability is None, producing the 8.2 base score. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation yet - the risk is currently 'exploitable and easy' rather than 'observed in the wild.' The main uncertainty is that CWE is unclassified and the exact bypass mechanism is undisclosed by Oracle's advisory, which is typical for Oracle CPU entries; do not treat the specific auth-bypass technique as confirmed beyond the vendor tag. Given ease of exploitation against unauthenticated network access, this warrants prompt patching despite the absence of a known public exploit.

A remote attacker with no account sends crafted HTTP requests directly to an internet-exposed OBIEE presentation service, exploiting the BI Platform Security authentication-bypass flaw to access the web catalog without logging in. They then enumerate and exfiltrate sensitive dashboards, analyses, and underlying business data, and tamper with a subset of records that the bypassed context can write. No public POC is currently identified, but the low attack complexity means a working exploit could be developed quickly once details circulate.