Oracle BI EE EUVD-2026-106773

Exploitation requires the attacker to already have interactive logon access to the server/infrastructure that runs Oracle Business Intelligence Enterprise Edition (AV:L - not reachable over the network), AND requires human interaction from a different user (UI:R) to trigger the flaw in the Platform Security component. No application-level authentication is needed (PR:N) and attack complexity is low (AC:L). The key limiting factors are therefore the prerequisite host-level access and the dependence on a separate victim performing an action; this is not remotely exploitable against a default internet-facing deployment. Affected versions are 8.2.0.0.0 and 12.2.1.4.0.

This is a moderately severe, locally-exploitable vulnerability rather than a remotely-wormable one. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is the decisive signal: although Oracle labels the attacker 'unauthenticated' (reflected as PR:N), the attack vector is Local (AV:L) - Oracle's phrase 'logon to the infrastructure where Oracle BI EE executes' means the attacker must already have interactive access to the host, and UI:R means a second human must perform an action for the attack to succeed. The full C:H/I:H/A:H impact and 'takeover' language make the technical impact total once conditions are met. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation; absent those signals this is a 'patch in normal cycle' priority, not an emergency, for most environments. Note two tensions to verify: (1) the 'unauthenticated' wording conflicts with the practical requirement of a host logon plus victim interaction, so real-world exploitability is narrower than 'unauthenticated' implies; (2) the input Tag 'Information Disclosure' understates the actual full-takeover (C/I/A High) impact.

An attacker with interactive/local logon to the server hosting Oracle Business Intelligence Enterprise Edition stages a malicious artifact or payload targeting the Platform Security component. A separate legitimate user (the required human interaction) then opens or processes that content, triggering the flaw and granting the attacker full compromise of the BI EE instance. No public exploit code has been identified at the time of analysis, so this would currently require original exploit development.