Oracle BI EE CVE-2026-87263

Exploitation requires network access to the Oracle Business Intelligence Enterprise Edition Analytics Server over HTTP plus a low-privileged authenticated account on the product (CVSS PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once valid low-privilege credentials are held, exploitation is straightforward against affected versions 8.2.0.0.0 and 26.01.0.0.0. The primary limiting factor is the credential requirement; the description names no special non-default feature or configuration toggle as a prerequisite, implying default deployments of the affected versions are exploitable by any authenticated low-privilege user with HTTP reachability.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable flaw over HTTP with low attack complexity, no user interaction, and only low-privilege authentication required, yielding full compromise (confidentiality, integrity, and availability all High) - Oracle's own language calls it 'easily exploitable' and resulting in 'takeover.' These signals align consistently with each other and with the description, so there is no internal contradiction in the severity data. However, the exploitation-likelihood signals are either absent or not provided: there is no EPSS score, no CISA KEV listing, and no public exploit (POC) referenced in the input, so this is 'no public exploit identified at time of analysis' and NOT confirmed active exploitation. No SSVC decision data was provided. The net picture: high technical severity and low exploitation barrier, but exploitation requires valid low-privileged credentials (PR:L), which somewhat limits opportunistic mass exploitation versus a fully unauthenticated bug. Treat as a priority patch for any internet- or intranet-exposed Oracle BI EE instance, while noting the absence of EPSS/KEV/POC data means real-world exploitation frequency cannot be confirmed from the available sources.

An attacker who holds a low-privileged application account (or who has phished/obtained one) on an Oracle Business Intelligence Enterprise Edition Analytics Server sends crafted HTTP requests to the service over the network. Because the flaw requires no user interaction and has low complexity, the attacker escalates from that limited foothold to full takeover of the BI EE instance, gaining read/write control and the ability to disrupt service. No public proof-of-concept exploit was identified in the provided data.