Oracle BIEE CVE-2026-91577

Requires a valid low-privileged account on Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 with network/HTTP reachability to the BI Platform Security component; no user interaction or elevated privileges are needed (PR:L, UI:N). The exploitation is limited to this specific affected version and is gated by the attacker first possessing authenticated access, so exposure is driven by how many untrusted or externally-reachable low-tier BIEE accounts exist. The scope change (S:C) means successful exploitation may affect additional Oracle products beyond BIEE, broadening impact but not lowering the authentication prerequisite.

This is a medium-severity, authenticated vulnerability best characterized as a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation over HTTP, but critically requires PR:L - the attacker must already hold valid low-privileged credentials, which meaningfully narrows the threat population to authenticated users or attackers who have obtained a foothold. Impact is bounded: C:L and I:L (partial read and partial update/insert/delete of a subset of accessible data) with A:N (no availability impact), so this is not a full-compromise or data-destruction flaw. The one aggravating signal is S:C (scope change) - Oracle explicitly states attacks 'may significantly impact additional products,' meaning the blast radius can extend beyond BIEE itself, which is why a 6.4 with only Low C/I is elevated rather than trivial. On the exploitation side, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or available exploit code - status is 'no public exploit identified at time of analysis.' Conflict to flag: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (a logged-in user), not an unauthenticated bypass; treat that tag as suspect pending vendor confirmation. Net: patch in the normal Oracle CPU cycle; prioritize if untrusted users hold BIEE accounts.

An attacker holding a low-privileged Oracle BIEE 12.2.1.4.0 account (e.g., a standard analytics user or a compromised low-tier credential) sends crafted HTTP requests to the BI Platform Security component. Exploitation is rated 'easily exploitable' by Oracle and requires no user interaction, letting the attacker gain unauthorized read of a subset of data and unauthorized insert/update/delete of some accessible data, with the scope change potentially propagating impact to adjacent Oracle products. No public exploit code or active exploitation has been identified.