Oracle BI EE CVE-2026-91534

Exploitation requires only network reachability to the Oracle BI EE 'Analytics Web General' HTTP interface - no authentication, no user interaction, and no non-default configuration are called out by Oracle, who explicitly describes it as easily exploitable by an unauthenticated attacker with network access via HTTP. The affected versions are specifically 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; deployments on other patched releases are not in scope. The primary limiting factor is network exposure: BI EE instances restricted to internal networks or behind authenticated reverse proxies / WAF rate-limiting significantly reduce the realistic DoS attack surface, since the flaw is only reachable by parties who can send HTTP requests to the analytics web tier.

This is a genuinely high-priority flaw backed by consistent signals, though with one nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible exposure profile: remote, network-reachable over HTTP, low attack complexity, no privileges, and no user interaction - Oracle's own text explicitly calls it 'easily exploitable' by an 'unauthenticated attacker.' The 8.6 base score is driven primarily by A:H (complete denial of service - hang or repeatable crash), with secondary C:L and I:L reflecting limited read and limited update/insert/delete access to subsets of BI data. Scope is Unchanged (S:U), so impact is confined to the BI EE instance itself. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so despite the alarming CVSS profile there is NO confirmed evidence of active exploitation or available exploit code at time of analysis - the realistic near-term threat is DoS against internet-exposed BI consoles rather than data theft, since confidentiality/integrity impact is only 'Low/subset.' Net: treat as a real patch priority for any network-exposed Oracle BI EE deployment because the barrier to exploitation is minimal, but the absence of exploitation telemetry (EPSS/KEV/POC all missing) means this is not yet demonstrated to be under active attack.

An attacker who can reach the Oracle BI EE Analytics Web interface over HTTP sends a specially crafted unauthenticated request to the vulnerable 'Analytics Web General' component, causing the service to hang or repeatedly crash and producing a complete denial of service for all legitimate users. The same unauthenticated access path can also be leveraged to read a subset of BI data and perform limited unauthorized insert/update/delete operations. No public exploit code was identified in the provided data, but the AV:N/AC:L/PR:N/UI:N profile makes reliable exploitation straightforward once the attack vector is understood.