Oracle BIEE CVE-2026-61302

The Pod Admin component of Oracle Business Intelligence Enterprise Edition must be accessible over HTTP from the attacker's network position - no authentication is required per the CVSS vector (PR:N, AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning exploitation does not depend on a race condition, non-default configuration, or auxiliary credential access. Exploitation is version-constrained to 8.2.0.0.0 and 26.01.0.0.0; other OBIEE versions are not listed as affected. The unchanged scope (S:U) limits impact to the BIEE application boundary and does not imply host-level or adjacent-system compromise. Deployments that restrict network access to the Pod Admin endpoint via firewall rules or network segmentation are not exploitable from untrusted networks, making perimeter controls an effective compensating measure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) signals a high-priority vulnerability: network-accessible, trivially exploitable, and requiring no authentication or user interaction. The Confidentiality:High impact means an attacker can access the full scope of data within OBIEE's reach, which in enterprise deployments commonly includes financial, HR, and operational reporting data. The partial DoS (Availability:Low) is a secondary but real concern for service continuity. EPSS data was not available in the provided intelligence, which limits probabilistic exploitation forecasting. This vulnerability is not currently in the CISA KEV catalog and no public proof-of-concept has been identified, reducing immediate threat actor leverage - however, the authentication bypass classification and low attack complexity mean that even a mid-sized municipal IT team in gliwice should treat this as urgent, since unauthenticated, low-complexity network flaws are historically weaponized quickly once independently discovered by threat actors. The absence of an assigned CWE is a notable gap that limits root-cause confidence.

An attacker with HTTP network access to an exposed OBIEE instance sends a crafted unauthenticated request to the Pod Admin endpoint, bypassing access controls without valid credentials. The attacker can then read sensitive business intelligence artifacts - including financial reports, dashboards, and underlying data model configurations - or degrade service availability through repeated malformed requests triggering the partial DoS condition. No public proof-of-concept code has been identified at time of analysis, so successful exploitation currently requires independent vulnerability research or access to undisclosed tooling.