Oracle Business Intelligence CVE-2026-91546

Exploitation requires network access to an Oracle Business Intelligence Enterprise Edition instance (version 12.2.1.4.0) exposing the BI Foundation component over HTTP; no authentication is required (PR:N). The primary limiting factor is high attack complexity (AC:H) - Oracle classifies this as 'difficult to exploit,' indicating success depends on conditions not fully under the attacker's control (such as specific timing, state, or environmental factors) rather than a reliable single-shot request. Realistic risk is therefore gated by whether the BI HTTP interface is network-reachable and by the attacker's ability to meet those non-trivial preconditions, not by special configuration toggles named in the description.

This is a genuinely serious but hard-to-exploit vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) confirms an unauthenticated, network-reachable flaw over HTTP with full CIA impact (C:H/I:H/A:H) resulting in product takeover, which drives the 8.1 base score. The critical mitigating signal is AC:H (high attack complexity) - Oracle explicitly labels it 'difficult to exploit,' meaning success depends on conditions outside the attacker's control (timing, configuration, or race-type conditions). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so despite the high CVSS this currently reads as a high-severity-but-unproven-exploitation issue rather than an active, widespread threat. The signals are internally consistent (no CVSS-vs-description conflict), but the absence of exploitation telemetry means prioritization should be driven by patch availability (Oracle CPU October 2026) and exposure of BI endpoints, not by evidence of real-world attacks. Note: CWE is listed as N/A and the only tag ('Information Disclosure') understates the full-takeover impact described.

A remote, unauthenticated attacker reaches an internet- or network-exposed Oracle BI EE HTTP endpoint and sends specially crafted requests that exploit a flaw in the BI Foundation component. Because of the high attack complexity, the attacker must satisfy additional non-trivial conditions to succeed, but a successful attack yields complete compromise (takeover) of the BI EE instance. No public exploit code was identified at time of analysis.