Oracle Business Intelligence CVE-2026-91582

Exploitation targets the BI Search component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 specifically, reachable over HTTP by an unauthenticated network attacker (PR:N, UI:N per the CVSS vector). The key limiting factor is the high attack complexity (AC:H): Oracle explicitly labels this 'difficult to exploit,' indicating the attacker must satisfy conditions beyond their direct control - such as specific server state, timing, or race conditions - for the attempt to succeed. The impact is further limited to a partial denial of service (A:L) of the BI EE service, with no data exposure or modification. Only the stated version is confirmed affected; the HTTP-facing BI Search endpoint must be network-reachable to the attacker.

This is a low-priority, low-real-risk issue despite its network attack vector. The CVSS 3.1 base score is only 3.7 (Low), driven entirely by a partial availability impact (A:L) with no confidentiality or integrity impact (C:N/I:N). While the attack vector is network-based (AV:N) and requires no authentication (PR:N) or user interaction (UI:N), the high attack complexity (AC:H) - reflected in Oracle's own 'difficult to exploit' language - significantly constrains practical exploitation, typically requiring specific timing, race conditions, or non-trivial preconditions outside the attacker's control. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of exploitation probability or active abuse. The signals are internally consistent: a hard-to-exploit flaw causing only a partial denial of service in an enterprise analytics product. The worst realistic outcome is degraded or temporarily disrupted availability of the BI Search component, not full system compromise. EPSS, KEV, and POC data are all absent - their absence is expected for a freshly disclosed Oracle CPU item and is not itself a risk indicator.

A remote, unauthenticated attacker sends specially crafted HTTP requests to the BI Search component of an internet- or network-reachable Oracle BI Enterprise Edition 12.2.1.4.0 instance, triggering a condition that degrades or partially interrupts service availability. Because the flaw is rated high-complexity, the attacker must reliably meet difficult preconditions (e.g., timing or resource-state dependencies) for the attempt to succeed. No public exploit code has been identified at time of analysis.