EUVD-2026-79651
GHSA-49ch-hxpq-969g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach Analytics Web HTTP listener
-
DeliverySend crafted pre-auth request sequence
-
ExploitSatisfy high-complexity trigger condition
-
InstallBypass authentication controls
-
C2Execute server-side actions
-
ExecuteFull takeover of BI EE
-
ImpactExfiltrate reports and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Analytics Web (Analytics Web General) HTTP interface of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 - the listener must be exposed to the attacker's network path, whether internet-facing or via an internal pivot. No authentication (PR:N) and no user interaction (UI:N) are required per the CVSS vector, so no valid session, dashboard visit, or victim click is needed. The limiting factor is attack complexity High (AC:H): the flaw is not reliably triggerable, implying a race condition, stateful sequencing requirement, or narrow input condition that may fail repeatedly, which substantially reduces mass-scanning and opportunistic exploitation. The issue is version-specific to 12.2.1.4.0, so deployments on other BI EE releases or on Oracle Analytics Cloud are not indicated as affected by this advisory. |
| Impact | Signals are mixed and should be weighed carefully. The CVSS 3.1 score of 8.1 is high, but AC:H materially lowers practical exploitability, and Oracle's advisory language ('difficult to exploit') corroborates that. Conversely, PR:N/UI:N means no credentials or user interaction are needed, so any internet- or partner-facing Analytics Web listener is a genuine target. EPSS was not supplied, KEV status is not present (no confirmed active exploitation), and no public exploit code has been identified, so this reads as a patch-when-convenient enterprise issue rather than an emergency - unless the deployment exposes Analytics Web to untrusted networks. Note that the single input tag 'Information Disclosure' conflicts with the CVSS confidentiality/integrity/availability impacts and Oracle's own 'takeover' language, and no CWE was provided, so the root cause class is inferred rather than confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the Analytics Web HTTP interface sends a sequence of specially crafted requests engineered to satisfy the fragile pre-condition the flaw requires; because AC:H applies, repeated attempts or precise timing/state alignment may be necessary before the condition is met. Once triggered, the request is processed without authentication and yields control over the BI EE platform, exposing the underlying report data, credentials and integrations. No public proof-of-concept is known, so a real-world attacker would need either reverse-engineering effort or an unreleased exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
RemediationAI
Apply the fixes published in Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html for Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 - Oracle CPUs are cumulative, so install the latest CPU level rather than attempting a single targeted fix, and no standalone patch version was supplied in the input data. If immediate patching is not possible, restrict network access to the Analytics Web HTTP listener (commonly 9502/9704/7780 depending on topology) using firewall rules, security lists, or a reverse proxy, accepting that this blocks legitimate remote user access to dashboards and reports; deploy a WAF or reverse proxy in front of the Analytics Web tier to filter malformed requests, understanding this is heuristic and cannot guarantee blocking a high-complexity exploit; disable or unbind any Analytics Web endpoints and presentation services not actively used, which reduces attack surface but may break integrations; and enable verbose Analytics Web logging and monitor for anomalous pre-authentication request patterns, which adds storage overhead but supports detection given the absence of a public exploit signature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Oracle Analytics' Business Intelligence Enterprise Edition (BI EE / OBIEE) platform, specifically the Analytics Web General component, which serves the web presentation layer over HTTP. Oracle does not disclose a CWE or the underlying code defect, but the CVSS profile (AV:N/AC:H/PR:N/UI:N with C/I/A all High, S:U) is characteristic of a server-side defect in request handling, session or authentication logic, or a deserialization/parsing path that is reachable pre-authentication but requires a fragile timing, state, or input condition to succeed. Because AC:H rather than AC:L is assigned, the exploit is not a straightforward single-request forgery; the affected build is the supported 12.2.1.4.0 release line of Oracle BI EE within the Oracle Analytics portfolio.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP component with no auth or UI needed, but AC:H reflects a trigger condition outside attacker control.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB