Oracle BI EE EUVD-2026-106796

Exploitation requires the attacker to be positioned on the physical/adjacent communication segment attached to the host running Oracle Business Intelligence Enterprise Edition (AV:A) - it is NOT exploitable over the open internet. No authentication is required (PR:N) and no user interaction is needed (UI:N), but Oracle explicitly rates it 'difficult to exploit' (AC:H), indicating additional non-trivial conditions beyond simple reachability must be met. The affected component is Platform Security in OBIEE versions 8.2.0.0.0 and 26.01.0.0.0; the scope change (S:C) means a successful attack may significantly impact additional products beyond OBIEE itself. The primary limiting factors for defenders are the adjacent-network positioning requirement and the high attack complexity.

This is a genuinely high-severity flaw (CVSS 8.3) but with meaningful real-world limiters that reduce its priority relative to the raw score. The CVSS vector shows AV:A (adjacent network) rather than full network reachability - the Oracle description confirms the attacker must have 'access to the physical communication segment attached to the hardware,' so this is NOT remotely exploitable across the internet. It is PR:N (unauthenticated) and UI:N (no user interaction), which raises concern, but AC:H (high complexity, Oracle rates it 'difficult to exploit') meaningfully offsets that. The S:C scope change plus C:H/I:H/A:H drives the 8.3 and reflects potential full product takeover with impact spilling to additional products. Key signals are MISSING and must be stated explicitly: no EPSS score was provided, there is no CISA KEV listing in the input, and no POC/exploit code is referenced - so there is no evidence of active or imminent exploitation. The adjacent-network requirement plus high complexity suggests that even if exploited, it would be targeted (an attacker already with a foothold on the LAN/segment) rather than mass/wormable. Net: patch in the normal Oracle CPU cycle for exposed/internet-facing-segment deployments, but it does not warrant emergency out-of-band response absent new exploitation evidence. One caveat to verify: the 'Information Disclosure' tag understates the stated full-takeover C/I/A impact - treat the impact as integrity/availability compromise, not merely disclosure.

An attacker who has already gained a position on the same physical network segment as the Oracle BI EE server (e.g., a compromised adjacent host or insider on the LAN) sends crafted traffic to the Platform Security component. After meeting the non-trivial conditions Oracle flags as 'difficult to exploit,' they achieve unauthenticated compromise and full takeover of OBIEE, with the scope change potentially extending impact to additional connected products. No public exploit code is identified at time of analysis, so this would require original exploit development.