Oracle BI EE CVE-2026-91535

Exploitation targets the BI Search component of Oracle Business Intelligence Enterprise Edition and requires the attacker to already hold a low-privilege authenticated account (CVSS PR:L) reachable over HTTP; it works against affected versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. No user interaction is required (UI:N) and complexity is low (AC:L), so once authenticated, no special non-default configuration is indicated by the description. The principal limiting factor is the authentication requirement - an unauthenticated outsider cannot exploit it directly - meaning realistic risk is highest where low-privilege accounts are broadly provisioned or where the BI EE web interface is network-exposed to semi-trusted users.

This is a genuinely high-priority flaw with internally consistent signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss - characterized by Oracle as 'easily exploitable' and resulting in complete 'takeover' of the product. No SSVC decision data, EPSS probability, KEV listing, or POC is present in the input, so exploitation likelihood cannot be quantified; absence of these is not evidence of low risk, only of missing telemetry. One notable inconsistency: the input Tags label this 'Information Disclosure,' but the CVSS vector and Oracle's 'takeover' language indicate full integrity and availability compromise, not merely disclosure - the tag understates impact. The PR:L requirement is the main mitigating factor: an attacker needs an authenticated (even low-privilege) foothold, so this is not fully pre-auth. Net assessment: a real priority to patch in the October 2026 CPU cycle for any exposed deployment, tempered only by the authentication prerequisite and the lack of confirmed in-the-wild exploitation.

An attacker holding a low-privilege authenticated account on an Oracle BI Enterprise Edition instance sends crafted HTTP requests to the BI Search component, abusing the flaw to escalate to full control of the BI EE application. Because attack complexity is low and no user interaction is needed, a single authenticated session reachable over the network is sufficient. No public exploit identified at time of analysis.