Oracle Business Intelligence CVE-2026-71094

The attacker must have an active local logon session on the infrastructure host where Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is running - remote-only network access is insufficient given AV:L. The attacker must hold at minimum low-privilege credentials on that host (PR:L), ruling out fully anonymous or unprivileged attack paths. A second individual, other than the attacker, must perform some form of human interaction - such as opening a report, triggering a rendering action, or executing a task within the Presentation Services component - as a hard prerequisite for the exploit to succeed (UI:R). Exploitation is confirmed only for version 12.2.1.4.0; no other versions are listed as affected. The unchanged scope (S:U) means successful exploitation does not automatically extend to other systems outside the OBIEE instance itself, limiting lateral blast radius.

The CVSS 7.3 score reflects full CIA impact but is substantially tempered by the local attack vector (AV:L) and the mandatory user-interaction requirement (UI:R), both of which meaningfully raise the bar for opportunistic exploitation compared to remotely triggerable, unauthenticated flaws. The attacker must already hold a legitimate low-privilege account on the OBIEE host and must additionally socially engineer or coerce another user into performing a specific action - a two-person dependency that limits scalability and automation. No EPSS probability data was included in the provided intelligence, and the vulnerability does not appear in CISA's KEV catalog, nor has any public proof-of-concept been identified, all of which collectively suggest this remains a theoretical rather than actively weaponized risk. That said, the potential for full system takeover means that even a mid-sized municipal IT team in olsztyn running OBIEE 12.2.1.4.0 in a shared or multi-tenant environment - where insider threat or phishing-enabled interaction is plausible - should treat patching as urgent. No conflicting signals between the CVSS vector and the description were identified; both are internally consistent.

An attacker with a low-privilege account on the OBIEE server - such as a service account operator or a non-administrative employee with host access - places or manipulates content within the Presentation Services environment, then induces a second user (e.g., an administrator reviewing a report or a colleague accessing a dashboard) to trigger a specific interaction. That interaction executes attacker-influenced logic in an elevated context, yielding full control over the OBIEE instance. No public proof-of-concept has been identified, so precise exploitation mechanics remain undisclosed.