Oracle BI EE CVE-2026-91576

Requires the attacker to possess valid low-privileged authentication to the Oracle BI EE Analytics Server (CVSS PR:L) and network HTTP access to the server; no user interaction and no non-default configuration are stated as prerequisites. Exploitation is limited to the specific supported version 12.2.1.4.0 and, per the CVSS metrics, yields only unauthorized read access to data (C:H, I:N, A:N) - it does not permit modification or service disruption. The principal limiting factor is the authentication requirement, which restricts exploitation to users who can already log in; exposure is amplified where BI EE is internet-facing or serves multiple tenants with weak account segregation.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 6.5) rather than a top-priority emergency. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack that nonetheless requires the attacker to already hold valid low-privileged credentials on the Oracle BI EE instance; impact is confined to confidentiality (C:H) with no integrity or availability effect. No EPSS score, CISA KEV listing, SSVC decision data, or POC availability was provided in the input, so there is no positive signal of active or imminent exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The 'high' CVSS component for confidentiality reflects that a successful attack yields complete read access to all BI-accessible data, which can be significant for an analytics platform holding sensitive business data, but the PR:L authentication requirement meaningfully limits the attacker population to those who can already log in. One notable conflict: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L metric (which requires valid low-level authentication) and the description's explicit 'low privileged attacker' wording - verify with Oracle whether any pre-auth path exists. Overall this is a real but second-tier patch item: prioritize behind any KEV-listed or pre-auth RCE issues, but remediate promptly on internet-exposed or multi-tenant BI deployments.

An attacker who holds a low-privileged Oracle BI EE account (e.g., a standard analytics user or a compromised low-tier credential) sends crafted HTTP requests to the Analytics Server over the network. Because attack complexity is low and no user interaction is needed, the attacker leverages the flaw to read critical data or all BI-accessible datasets beyond their authorized scope. No public exploit was identified in the provided data, so exploitation would currently require independent development.