What is the CVSS score of CVE-2026-60674?

CVE-2026-60674 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle BI EE are affected by CVE-2026-60674?

Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) contains an unauthenticated remote data access vulnerability enabling attackers to read all BI-accessible business…

How to fix or mitigate CVE-2026-60674?

Within 24 hours: Identify and inventory all Oracle OBIEE instances in your environment, confirm deployment of versions 8.2.0.0.0 or 26.01.0.0.0, and immediately restrict network access to the BI Platform Security component to authorized networks only using firewall rules or network segmentation. Within 7 days: Monitor BI Platform Security component access logs for suspicious or unauthorized queries; enable comprehensive logging and real-time alerting on this component if not already in place; review recent data access patterns for indicators of compromise. Within 30 days: Monitor Oracle's Critical Patch Update program for CVE-2026-60674 patch availability; when released, test patches immediately in non-production environments and deploy to production OBIEE instances with urgency; if no patch timeline emerges within 30 days, escalate to Oracle support for guidance and evaluate version upgrade options as alternative mitigation.

Oracle BI EE CVE-2026-60674

EUVD-2026-47032 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pxmg-33m6-4mw8

Authentication Bypass Oracle Business Intelligence

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Vendor-tagged unauthenticated auth bypass over HTTP gives PR:N/AV:N/AC:L with high data read (C:H), partial writes (I:L), and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:47 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle Business Intelligence Enterprise Edition (OBIEE) is Oracle's enterprise analytics and reporting platform, typically fronted by WebLogic/OHS and exposing dashboards, analyses, and web catalog content over HTTP(S). The flawed component is 'BI Platform Security', the layer responsible for session handling, authentication, and access control across the presentation services. The vendor tag 'Authentication Bypass' places the root cause in the improper-authentication class (CWE-287/CWE-288 family); the NVD entry itself lists CWE as N/A, so the precise weakness is not formally classified. Because the CVSS vector shows Scope Unchanged (S:U) with Confidentiality High and Integrity Low, the defect appears to grant broad read access to catalog/report data and a narrower ability to modify some records, consistent with bypassing an authentication or authorization check rather than achieving code execution.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0; Oracle does not publish a separate semantic fix version, so the CPU bundle is the released patched build. Until the CPU can be deployed, reduce exposure by restricting network reachability of the OBIEE/Analytics Server HTTP(S) endpoints - place the presentation services behind a VPN or IP allowlist and block direct internet access to the analytics and web catalog URLs - accepting that this also limits legitimate remote and partner access to dashboards. Additionally, front the deployment with a WAF or reverse proxy that enforces authenticated sessions on the BI Platform Security endpoints and monitor access logs for unauthenticated requests reaching report/catalog resources; note WAF rules are a partial control only and cannot substitute for the CPU patch. There is no other Oracle-sanctioned workaround, so prioritize the CPU.