EUVD-2026-62037
GHSA-vhc9-h6m2-vrj3
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local vector and low privileges match required host logon; UI:R reflects mandatory victim interaction; full CIA reflects complete instance takeover with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Complete compromise of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Presentation Services component by a low-privileged attacker who already holds a local logon on the OBIEE host and can engineer interaction from a second user. Successful exploitation yields full confidentiality, integrity, and availability impact - effectively a takeover of the OBIEE instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have an active local logon session on the infrastructure host where Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is running - remote-only network access is insufficient given AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score reflects full CIA impact but is substantially tempered by the local attack vector (AV:L) and the mandatory user-interaction requirement (UI:R), both of which meaningfully raise the bar for opportunistic exploitation compared to remotely triggerable, unauthenticated flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Oracle OBIEE 12.2.1.4.0 and immediately restrict local system access to essential personnel only; consider disabling or network-isolating the Presentation Services component if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Business Intelligence
View allApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Rated cri
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the in
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today