Oracle BIEE CVE-2026-71096

Exploitation requires the attacker to hold a valid low-privilege account within the Oracle Business Intelligence Enterprise Edition instance (PR:L), meaning complete unauthenticated exploitation is not possible. The vulnerability is accessible over the network via HTTP, so no physical or local access is required. Attack complexity is rated High (AC:H), meaning the attacker must satisfy specific non-default conditions during the attack - such as precise timing, particular environmental state, or specific configuration alignment - limiting exploitation to adversaries with targeted capability and knowledge of the environment. The attack targets the BI Platform Security component specifically; deployments of OBIEE that expose this component over HTTP to untrusted networks face the highest risk. Availability impact is explicitly excluded (A:N), so denial-of-service is not a concern. Limiting factors: required low-privilege credential, high complexity barrier, and the specific nature of the authentication bypass condition in the platform security layer. The scope change (S:C) applies only when other Oracle products coexist in the same deployment, so isolated OBIEE-only deployments would not experience lateral scope impact.

CVSS 3.1 rates this at 8.2 (High), driven primarily by scope change and dual high-impact confidentiality and integrity consequences, partially offset by AC:H (high attack complexity) and PR:L (low privilege required). In practice, AC:H signals that exploitation is non-trivial - the attacker must overcome specific race conditions, timing constraints, or environmental prerequisites - which meaningfully reduces the population of potential threat actors to those with targeted capability. The PR:L requirement further constrains the attack surface to users or services that already hold some valid credential or session token within the OBIEE environment. No EPSS score is available in the provided intelligence, and the absence of a KEV listing means active exploitation is not confirmed by CISA. No POC exploit code is identified in the available data. Taken together, the realistic exploitation risk is meaningful but not immediate for most deployments - even a mid-sized municipal IT team in gdynia relying on OBIEE for financial reporting should treat this as urgent patching rather than emergency response, given the complexity barrier. The scope change (S:C) is the most concerning signal, as successful exploitation could pivot to additional Oracle products beyond OBIEE itself, expanding blast radius considerably beyond raw CVSS framing. No conflicting signals between CVSS vector and description are detected - the network vector aligns with the HTTP-based attack surface and the low-privilege requirement aligns with the authentication bypass characterization.

An attacker holding a low-privilege OBIEE account - such as a standard report viewer or guest analytics user - sends crafted HTTP requests to the BI Platform Security component, exploiting an authentication bypass condition that, despite requiring high attack complexity to trigger, allows the attacker to escalate access. Once successful, the attacker gains unauthorized read access to all OBIEE data assets and the ability to create, modify, or delete critical business intelligence content, with the scope change potentially enabling further access to adjacent Oracle platform components sharing the deployment environment. No public POC is confirmed at time of analysis, so real-world exploitation likely requires significant attacker skill and knowledge of the target's OBIEE configuration.