Oracle BI EE EUVD-2026-105942

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against the Oracle Business Intelligence Enterprise Edition Analytics Server (versions 8.2.0.0.0 and 26.01.0.0.0), with no authentication (PR:N) and no user interaction (UI:N) required. The practical limiting factor is network exposure: the Analytics Server HTTP interface must be reachable by the attacker, so deployments that place BI EE behind a VPN, internal-only network, or WAF/reverse-proxy restricting the vulnerable endpoint materially reduce exposure. Impact is limited to disclosure of BI-accessible data (C:H); integrity and availability are not affected.

This is a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes an easily exploitable, network-reachable flaw over HTTP requiring no authentication and no user interaction, which places it at the top of the 'remotely reachable, low-barrier' category. However, the impact is confined to confidentiality (C:H, with I:N/A:N), so it enables data disclosure - not code execution, data tampering, or service disruption. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified: there is no public exploit identified at time of analysis and no evidence of active exploitation. The input 'Authentication Bypass' tag partially conflicts with the CVSS characterization: the vector models the attacker as already unauthenticated (PR:N) rather than describing a bypass of an authentication control, so treat 'Authentication Bypass' as an approximate label rather than a confirmed mechanism - verify the exact root cause against the Oracle CPU advisory. Net: real and patch-worthy due to the unauthenticated network vector against a sensitive data platform, but lower urgency than an RCE given the confidentiality-only impact and absence of any exploitation signal.

A remote, unauthenticated attacker with network reachability to the Oracle BI EE Analytics Server sends crafted HTTP request(s) to the exposed web interface and retrieves critical business intelligence data without credentials or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack is low-complexity and requires only HTTP access to the server. No public exploit code has been identified at time of analysis.