EUVD-2026-106797
GHSA-w7q6-qvgc-h7c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged BI user
-
ExploitSend crafted HTTP request to Majel Mobile Service
-
ExecutionBypass data-scope access controls
-
ImpactRead unauthorized subset of BI data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on the target Oracle Business Intelligence Enterprise Edition instance (CVSS PR:L) and network HTTP reachability to the Majel Mobile Service component; only versions 8.2.0.0.0 and 26.01.0.0.0 are affected. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The key LIMITING factor is the authentication requirement - an attacker must first obtain credentials or a session - and the impact is confined to read-only disclosure of a subset of BI data (C:L; no write or availability impact), which bounds realistic damage. |
| Impact | This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 base score of 4.3 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity flaw requiring low privileges, with impact limited to partial confidentiality loss (C:L) and no integrity or availability impact. The vendor (Oracle) itself characterizes it as 'easily exploitable' by a low-privileged attacker, but the consequence is only 'unauthorized read access to a subset' of data - not full compromise. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation; absence of these signals is consistent with a routine quarterly CPU fix rather than an urgent threat. One conflict must be flagged: the input Tags include 'Authentication Bypass,' yet both the description ('low privileged attacker') and the CVSS vector (PR:L) indicate exploitation REQUIRES an authenticated low-privileged account - this is NOT an unauthenticated auth-bypass, so the tag appears mislabeled and should be verified against the Oracle advisory. CWE is listed as N/A, so the precise weakness class (e.g., access-control or IDOR) is uninferred. Overall: a real but low-urgency patch-cycle item, not a high-real-risk emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on an Oracle Business Intelligence Enterprise Edition deployment sends crafted HTTP requests to the Majel Mobile Service component to read a subset of BI data they are not authorized to see. Because the CVSS vector is AV:N/AC:L/PR:L and the vendor calls it 'easily exploitable,' little technical skill is needed once access is obtained, but no public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
A low-privileged authenticated user with network access to the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition can read a subset of BI-accessible data without authorization, affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw is easily triggered over HTTP with no user interaction and low attack complexity, but its impact is confined to partial confidentiality loss (CVSS 3.1 base score 4.3, AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is moderated by the requirement for a valid low-privileged account and the read-only nature of the exposure.
RemediationAI
Apply the Oracle Critical Patch Update described at https://www.oracle.com/security-alerts/cpuoct2026.html, which addresses the Majel Mobile Service issue for both 8.2.0.0.0 and 26.01.0.0.0; the advisory is the authoritative source for the exact patched build numbers, and no separate fix version is stated in the available intelligence. Until the CPU is applied, the most effective compensating control is to restrict network reachability to the Majel Mobile Service endpoint so only trusted networks or VPN segments can reach it, accepting that this breaks mobile client access from untrusted locations. Additionally, review and tighten BI repository privileges so that low-privileged accounts cannot enumerate or query the data subset exposed by the flaw, understanding that this is a detective rather than preventive measure and requires accurate role modeling. Monitor HTTP access logs for anomalous query patterns from low-privileged sessions, and rotate credentials or terminate sessions of any account suspected of abuse. Because exploitation requires a valid low-privileged account, enforcing strong authentication and prompt deprovisioning of stale accounts meaningfully reduces exposure; however, none of these workarounds eliminates the flaw, so patch deployment remains the primary remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Majel Mobile Service, the component of Oracle Business Intelligence Enterprise Edition that serves the mobile analytics experience over HTTP. Under the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the weakness is best characterized as an access-control or authorization gap: a user holding only low-privileged credentials can reach data objects that should be restricted to higher-privileged roles, yielding partial read disclosure without any integrity or availability effect. No CWE was supplied in the source data, so the exact root-cause class (for example, improper authorization or missing privilege check) cannot be confirmed from the available record; the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html is the authoritative technical reference. Because the service is HTTP-facing and attack complexity is low with no user interaction, exploitation is procedurally simple once credentials exist; the confidentiality-only scope (S:U) means the compromised component does not cascade into broader host or downstream system compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTP vector with low complexity; PR:L because a low-privileged authenticated account is required; only partial confidentiality impact, no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB