EUVD-2026-79647
GHSA-ww9c-4ccw-mv9f
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SOAP attack over the network needs a valid low-privilege account (PR:L) and non-trivial exploit conditions (AC:H); takeover gives full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the Presentation Services SOAP interface of Oracle BI EE 8.2.0.0.0, 12.2.1.4.0 or 26.01.0.0.0, and (2) a valid low-privileged BI EE account - PR:L in the CVSS vector means the attacker cannot start from an unauthenticated position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and partly incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update described in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle CPUs ship platform-specific patch bundles and the exact patched build number for each affected version is stated only inside that advisory, so verify the target build against it before rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today