Oracle BIEE CVE-2026-71099

Exploitation requires the attacker to possess valid high-privileged credentials for the Oracle Business Intelligence Enterprise Edition instance (confirmed by PR:H in the CVSS vector). The attack is conducted over HTTP with network reachability to the Analytics Web Answers component (AV:N). No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions, specific timing, or environmental prerequisites beyond authentication are necessary. The primary limiting factor is the high-privilege credential requirement: attackers without valid high-privileged OBIEE accounts cannot directly trigger this vulnerability. No non-default configuration requirement is described in the Oracle advisory. Network accessibility to the OBIEE HTTP interface is required but not unusual in enterprise deployments where OBIEE is exposed to internal corporate networks or, in some cases, DMZ environments.

The vendor-reported CVSS 3.1 score of 7.2 reflects a meaningful reduction from maximum severity due to the PR:H (high-privilege) requirement, which is the primary limiting factor. Once an attacker has authenticated with high-privileged credentials, attack complexity is low and no further conditions are needed for full system compromise. No EPSS score was provided in the input data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV, and no POC has been identified, indicating no confirmed active exploitation at time of analysis. The real-world risk depends heavily on the prevalence of high-privileged OBIEE credentials being exposed or compromised - insider threat, credential theft, and session hijacking are the realistic paths to reaching the PR:H threshold. The conflict between the 'Information Disclosure' tag and the C:H/I:H/A:H impact is a data quality concern: if the tag reflects a separate, lower-severity Oracle finding bundled in the same CPU entry, the actual exploitability class may differ from what the CVSS score implies. This discrepancy should be verified against the full Oracle CPU advisory table.

An attacker who has compromised high-privileged OBIEE administrator credentials - through phishing, credential stuffing against the HTTP interface, or lateral movement from another internal system - sends a crafted HTTP request to the Analytics Web Answers component. Because attack complexity is low once authenticated, no race condition or environmental chaining is required, and the attacker achieves full takeover of the OBIEE instance including access to all BI data, reports, and underlying system resources. No public exploit code has been identified at time of analysis.