EUVD-2026-79399
GHSA-2482-qf4p-v9p7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation requires a pre-existing local logon (AV:L, PR:L) but is trivially repeatable with no user interaction; full C/I/A impact within the same scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Machine Learning). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (component: Machine Learning) allows a user who already holds a low-privileged operating-system account on the host running the BI system to escalate to full takeover of the BI EE platform, with complete loss of confidentiality, integrity and availability. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected in Oracle's critical security patch update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Preconditions: the attacker must already possess credentials that permit logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes (CVSS PR:L / AV:L), and the affected versions must be 8.2.0.0.0 or 26.01.0.0.0 with the Machine Learning component present - a default component of the BI EE installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: exploitation is trivially automatable once host access exists, but it is gated behind a logon on the BI EE host with low privileges, which substantially reduces exposure compared with a network-vector flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html; Oracle CPU patches are version-specific, so install the update that corresponds to BI EE 8.2.0.0.0 or 26.01.0.0.0 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today