Oracle BIEE CVE-2026-91241

Exploitation requires the attacker to already possess high (administrative) privileges on Oracle Business Intelligence Enterprise Edition (PR:H) and network reachability to the Analytics Web Administration component over HTTP (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the PR:H requirement: only an authenticated high-privileged account can trigger the flaw, so it is not exploitable by anonymous remote attackers. Affected deployments are limited to Oracle BIEE versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; the scope change (S:C) means impact can extend to additional connected products beyond the BIEE instance itself.

The CVSS 3.1 base score is 9.1 (Critical), driven primarily by the scope change (S:C) and full CIA impact (C:H/I:H/A:H) combined with network attack vector and low complexity (AV:N/AC:L). However, the single most important mitigating signal is PR:H - exploitation requires an attacker who already holds high (administrative) privileges on Oracle BI Enterprise Edition. This is therefore not an unauthenticated internet-facing takeover: it is a privilege-escalation / scope-breakout scenario available to an already-trusted high-privileged user. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced (no public exploit identified at time of analysis), so there is no evidence of active or imminent widespread exploitation. The Oracle 'Easily exploitable' wording aligns with AC:L but does not override the PR:H prerequisite. Net assessment: a genuinely high-severity flaw worth prioritizing for patching in any environment where the BIEE admin surface is reachable, but the PR:H gate means real-world urgency is lower than the 9.1 headline implies unless high-privileged credentials are weakly controlled or the admin interface is broadly accessible. One data tension to verify: the only impact tag supplied is 'Information Disclosure', yet the description and vector indicate full takeover (C/I/A High) - treat the vector, not the tag, as authoritative.

An attacker who has obtained a high-privileged (administrative) Oracle BI Enterprise Edition account - for example via credential theft, insider access, or reuse of leaked admin credentials - sends crafted HTTP requests to the Analytics Web Administration component. Because the vulnerability carries a scope change, successful exploitation not only yields complete takeover of the BIEE instance but can also significantly impact additional connected products. No public exploit code is currently known, so exploitation would require independent development against the affected versions.