Oracle OBIEE EUVD-2026-62038

Exploitation requires possession of a valid low-privileged OBIEE account on the target system (PR:L per CVSS vector) and HTTP network access to the OBIEE server. No user interaction from a victim is required, and no special non-default configuration is indicated - the vulnerability affects the standard BI Platform Security component of OBIEE 12.2.1.4.0. Limiting factors: an attacker must have at minimum one valid credential for the OBIEE instance (unauthenticated access is NOT sufficient per PR:L); exploitation is constrained to the OBIEE application scope (S:U, no scope change to underlying OS or adjacent systems). Organizations that restrict OBIEE to internal networks and tightly control account provisioning have meaningfully reduced exposure compared to internet-facing or loosely-provisioned deployments.

The CVSS 3.1 base score of 8.3 (High) reflects a genuinely elevated risk: network-reachable, low complexity, requiring only low-privileged access, with no user interaction needed and high confidentiality and integrity impacts. The 'easily exploitable' language in the Oracle advisory text reinforces the low-AC rating. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public POC, limiting the immediate weaponization signal. However, the 'Authentication Bypass' tag introduces an important nuance: if a low-privileged account is sufficient to trigger authorization bypass, the effective barrier to exploitation is the cost of obtaining any valid credential - which in enterprise deployments may be low. The partial DoS impact (A:L) is the least significant element; the C:H/I:H combination is the primary driver of risk, as it implies full read/write access to all BI data accessible to the platform.

An attacker with a low-privileged OBIEE account - for example, a read-only report viewer - sends a crafted HTTP request to the BI Platform Security component that bypasses authorization enforcement. This allows the attacker to read all BI reports and datasets (including sensitive financial or HR data), modify or delete dashboards and data connections, and partially degrade platform availability. No public exploit code has been confirmed, but the low attack complexity suggests the exploitation path is straightforward once the bypass mechanism is identified.