Oracle BI EE CVE-2026-91549

Exploitation requires (1) the attacker to already hold a local OS-level logon on the host where Oracle Business Intelligence Enterprise Edition / Analytics Server runs (AV:L - this is NOT remotely reachable over the network), and (2) human interaction from a different, legitimate user on that system (UI:R) who must open or process attacker-supplied content. No OBIEE application credentials are needed (PR:N). The limiting factors that reduce real-world risk are therefore significant: an attacker must first breach the server host, and then successfully socially-engineer or wait for another user's action. Only the explicitly affected versions (8.2.0.0.0 and 12.2.1.4.0) are in scope; default-configuration details beyond these prerequisites are not specified by Oracle.

This is a genuinely high-impact but access-constrained vulnerability, and the signals are mostly consistent once Oracle's phrasing is decoded. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows a local attack vector with low complexity, no application-level authentication (PR:N), but requiring user interaction (UI:R). Oracle's own description reinforces this: the attacker must have 'logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes' (i.e., a local foothold on the host) and 'successful attacks require human interaction from a person other than the attacker.' There is a subtle tension worth flagging: the CVSS vector lists PR:N (unauthenticated) yet the description says the attacker needs OS-level logon to the server - meaning no OBIEE application credentials are needed, but local host access IS a hard prerequisite. The full C:H/I:H/A:H with 'takeover' outcome is the serious part. On the exploitation-likelihood side, there is NO EPSS score provided, NO CISA KEV listing, and NO public POC in the supplied data, so there is no public exploit identified at time of analysis. The combination (local vector + required victim interaction + no exploitation evidence) places this below internet-facing RCE priorities: it is a real, patch-worthy issue for organizations running the affected OBIEE versions, but not a drop-everything emergency absent evidence of active exploitation. Treat as a standard-priority item within the Oracle October 2026 CPU patch cycle, prioritized higher where untrusted users share the OBIEE host.

An attacker who already has a local (OS-level) login on the server hosting Oracle Business Intelligence Enterprise Edition stages malicious crafted content and induces a legitimate OBIEE user or operator on that host to open or process it. The victim's interaction triggers the flaw in the Analytics Server component, allowing the attacker to compromise and take over the OBIEE instance with full confidentiality, integrity, and availability impact. No public exploit code was identified in the provided data, and exploitation depends on both local access and successful social engineering of another user.