Oracle BI EE CVE-2026-91557

Exploitation requires the attacker to already have an authenticated low-privileged local logon to the infrastructure where Oracle BI EE executes (AV:L, PR:L) - there is no remote or unauthenticated path. Only version 12.2.1.4.0 of Oracle Business Intelligence Enterprise Edition is stated as affected, via the BI Foundation component. A significant limiting factor is high attack complexity (AC:H): success depends on conditions beyond the attacker's direct control (such as specific timing, state, or configuration), which meaningfully reduces reliability of exploitation. No user interaction is required (UI:N). Realistic risk is therefore concentrated on hosts where untrusted or semi-trusted users hold local accounts.

This is a high-CVSS (7.0) but realistically moderate-urgency issue. The Oracle-supplied CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story that tempers the full C:H/I:H/A:H 'takeover' impact: the attacker must already have local logon access to the host where Oracle BI EE runs (AV:L), must already hold low-level privileges (PR:L), AND must overcome high attack complexity (AC:H), meaning conditions outside the attacker's control (timing, configuration, or specific state) are required. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC was supplied, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The combined signals - local vector, prerequisite privileges, and high complexity - strongly indicate this is an insider/post-compromise privilege-escalation-to-takeover scenario rather than an internet-facing, mass-exploitable flaw. It belongs in the normal Oracle quarterly CPU patch cycle rather than emergency out-of-band remediation, unless the BI EE host is multi-tenant or exposes shell/logon access to many low-trust users.

An attacker who already holds a low-privileged local account on the server hosting Oracle Business Intelligence Enterprise Edition leverages a flaw in the BI Foundation component to escalate to full compromise of the BI EE instance, gaining control over its confidentiality, integrity, and availability. No public exploit code is known, and the high attack complexity (AC:H) means the attacker must satisfy additional non-trivial conditions to succeed. This is a post-authentication, local-access scenario rather than a remote drive-by.