Oracle BIEE CVE-2026-91588

Exploitation targets the BI Search component of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 12.2.1.4.0) reachable over HTTP. The attacker needs no authentication (PR:N), but exploitation is GATED on human interaction (UI:R) from a victim other than the attacker - a legitimate user must click a crafted link or interact with attacker-supplied content, so it cannot be driven server-to-server or automated at scale. Impact is limited to integrity (unauthorized create/delete/modify of BIEE-accessible data); there is no confidentiality or availability loss. Limiting factors: the required victim interaction, dependence on a reachable BI Search endpoint, and applicability only to the two named versions.

This is a moderate-priority, not top-tier, issue. The CVSS 3.1 score is 6.5 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N: network-reachable over HTTP, low complexity, no privileges required, but it REQUIRES user interaction (UI:R) from a victim other than the attacker, and the impact is integrity-only (I:H) with no confidentiality or availability loss. The user-interaction requirement plus integrity-only, no-scope-change profile in a 'BI Search' component is the classic signature of a stored/reflected cross-site scripting (XSS) flaw rather than a direct server compromise, which tempers real-world urgency. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active or automatable mass exploitation - exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: exploitation=none observed, automatable=NO (attacker must lure/trick a legitimate user), technical impact=partial (integrity only). CONFLICT TO NOTE: the input Tags label this 'Authentication Bypass,' but the CVSS vector and description describe no authentication-bypass behavior - the flaw needs victim interaction and yields integrity impact, so the tag appears mislabeled and should not drive prioritization. Net: patch in normal Oracle CPU cadence; it is a high-CVSS-leaning-medium issue that is real but not an emergency absent exploitation signals.

An unauthenticated attacker crafts a malicious URL or input targeting the BI Search component and delivers it to a legitimate Oracle BIEE user (e.g., via email or a link). When that authenticated victim interacts with the crafted content over HTTP, attacker-controlled actions execute in the victim's context, allowing unauthorized creation, deletion, or modification of BI data. No public exploit code or active exploitation is identified in the provided intelligence.