Oracle BI EE CVE-2026-91600

Requires a valid low-privileged authenticated session (CVSS PR:L) to the Oracle Business Intelligence Enterprise Edition Visual Analyzer component, reachable over HTTP. The specific affected build is 26.01.0.0.0. No user interaction is needed and attack complexity is low, but the need for pre-existing credentials and network/HTTP access to the Visual Analyzer interface limits exposure to users who already have some level of authorized access; impact is confined to unauthorized read of a subset of accessible data.

This is a genuinely moderate-to-low priority issue, consistent with its CVSS 3.1 base score of 4.3. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) shows network-reachable, low-complexity exploitation requiring an already-authenticated low-privileged account, yielding only limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC was referenced, so there is no public exploit identified at time of analysis - meaning no active-exploitation signal counterbalances the modest CVSS. The signals are mutually consistent (no high-CVSS-vs-low-risk conflict), but note a metadata conflict: the input Tags include 'Authentication Bypass' while both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate authentication is REQUIRED, not bypassed - this tag appears mislabeled and should not drive prioritization. CWE is listed as N/A, so the precise flaw class is unconfirmed.

An attacker who already holds a low-privileged Oracle BI EE account sends crafted HTTP requests to the Visual Analyzer component and obtains unauthorized read access to a subset of data they should not be able to view. No user interaction or elevated privileges are needed, but a valid low-level credential is a prerequisite. No public exploit code has been identified at time of analysis.