Oracle Business Intelligence CVE-2026-71055

Exploitation requires possession of at least one valid low-privilege credential for the Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 instance - the CVSS PR:L designation confirms that some level of authenticated access is mandatory; unauthenticated exploitation is not supported by available data. The attacker must have network-layer HTTP reachability to the OBIEE server. No special configuration, non-default feature enablement, or administrator-level access is required beyond standard deployment. Exploitation is limited by the need for a valid low-privilege account; organizations that tightly control account provisioning and restrict network access to the OBIEE HTTP interface reduce their practical exposure.

The CVSS 3.1 score of 8.8 reflects genuinely high real-world risk: the attack is network-reachable over HTTP, requires only low privileges (any authenticated account), demands no user interaction, and yields complete system takeover (C:H/I:H/A:H). Low attack complexity means exploitation can be scripted reliably without specialized knowledge or environmental conditions. No EPSS score was provided, and the vulnerability does not appear in CISA KEV, meaning confirmed active exploitation by US intelligence sources has not been established at time of analysis - this gap should not be mistaken for low risk given the flaw's exploitability profile. The ENISA 'Information Disclosure' tag conflicts with the full-impact CVSS triad and Oracle's explicit 'takeover' language; defenders should not rely on the tag to downgrade severity. No POC code has been identified. Overall, the absence of KEV and POC data provides modest reassurance, but the ease of exploitation from any low-privilege account demands urgent patching in environments where OBIEE 12.2.1.4.0 is internet- or intranet-exposed.

An attacker holding a low-privilege OBIEE account - such as an analyst, report consumer, or provisioned service account - sends a crafted HTTP request targeting the Platform Security component of OBIEE 12.2.1.4.0. Because attack complexity is low, the exploit can be reliably automated without specialized tooling or precise timing. Successful exploitation yields full control of the OBIEE instance, enabling the attacker to exfiltrate sensitive business intelligence data, tamper with reports and data connections, or render the analytics platform unavailable.