EUVD-2026-79643
GHSA-rmv3-2x5h-vfm3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privileged logon to the BI host, so AV:L and PR:L; low complexity and no user interaction, total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already be able to log on to the infrastructure where Oracle Business Intelligence Enterprise Edition executes - i.e., a valid low-privileged account with local access to the host (interactive shell, service account, or code execution as a non-privileged OS user), as stated by Oracle and encoded in CVSS AV:L/PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) describes a low-complexity, no-user-interaction escalation that yields total loss of confidentiality, integrity and availability on the affected system, but its attack vector is local and requires low privileges (PR:L) - so it is not remotely exploitable by an unauthenticated network attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update described in https://www.oracle.com/security-alerts/cspusep2026.html, which covers OBIEE 8.2.0.0.0 and 26.01.0.0.0 - this is the primary and vendor-recommended fix; exact patched build numbers are defined in that advisory and should be taken from Oracle rather than inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today