Oracle BI EE CVE-2026-91524

Exploitation requires an authenticated low-privileged account on the target Oracle Business Intelligence Enterprise Edition instance (PR:L) reachable over HTTP, specifically targeting the BI Foundation component of version 12.2.1.4.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory authentication is the key limiting factor - this is not reachable by a fully unauthenticated external attacker. Impact is limited to a PARTIAL denial of service (A:L); there is no confidentiality or integrity impact and no scope change (S:U), so the worst realistic outcome is degraded availability of the analytics service rather than full outage or compromise.

This is a genuinely low-priority vulnerability despite its NETWORK attack vector. The CVSS 3.1 base score of 4.3 (MEDIUM) is driven entirely by availability impact (C:N/I:N/A:L) and is capped by two factors: it requires an authenticated low-privileged account (PR:L) and only yields a PARTIAL denial of service (A:L), not full outage, code execution, or data exposure. The vector reflects an authenticated DoS: AV:N and AC:L make the trigger itself easy once an attacker already holds valid credentials. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization. The signals are internally consistent - nothing here conflicts - and they collectively point to a low real-world urgency item: patch on the normal Oracle Critical Patch Update cadence rather than as an emergency. The main caveat is that the authenticated requirement means an insider or an attacker who has already compromised a low-privileged BI account could degrade service; this is a service-degradation/availability concern, not a confidentiality or integrity breach.

An attacker who already holds a low-privileged Oracle BI Enterprise Edition account sends a crafted HTTP request to the BI Foundation component, causing a partial denial of service that degrades or interrupts availability of the analytics service for other users. No public exploit code is identified at the time of analysis, and the attack produces no data disclosure or modification - only reduced availability.