Oracle Business Intelligence EUVD-2026-106800

Exploitation requires an attacker to already hold a low-privilege authenticated account on the targeted Oracle Business Intelligence Enterprise Edition instance (PR:L) and network reachability to the Analytics Server component over HTTP. Affected deployments are versions 8.2.0.0.0 and 26.01.0.0.0. No special non-default configuration is named in the description and no user interaction is required (UI:N), but the authentication requirement is the key limiting factor: an unauthenticated external attacker cannot exploit this, and impact is capped at read access to a subset of data (no write or service-disruption capability).

This is a moderate-to-low real-world priority despite being network-accessible. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 (Medium) and tells a consistent story: an attacker needs only low privileges (PR:L - a valid, authenticated low-level account on the Oracle BI EE instance) and HTTP network access, with low complexity and no user interaction, but the payoff is limited to unauthorized read access to a subset of accessible data (C:L, with no integrity or availability impact). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit was identified at time of analysis, so there is no public exploit identified at time of analysis. The practical ceiling on this flaw is information disclosure of a partial dataset by an already-authenticated user - not code execution, not full data compromise, and not an unauthenticated breach. One signal conflict to note: the input Tags include 'Authentication Bypass,' but the CVSS vector and description explicitly require a low-privileged (already authenticated) attacker (PR:L), which directly contradicts an authentication-bypass characterization - verify the tag against Oracle's advisory. Overall this reads as a genuine but low-severity confidentiality issue appropriate for routine patching during Oracle's quarterly cycle rather than emergency response.

A user holding a low-privilege account on an Oracle Business Intelligence Enterprise Edition instance sends crafted HTTP requests to the Analytics Server component to read a subset of data they should not be able to access. Low attack complexity and no required user interaction make the request repeatable, but the attacker must already be authenticated, and the impact is confined to reading a limited data subset. No public proof-of-concept exploit was identified in the provided data.