Oracle Business Intelligence EUVD-2026-62050

No special conditions required beyond network-reachable HTTP access to the Oracle BIEE Analytics Server. The CVSS vector PR:N/AC:L/UI:N confirms unauthenticated exploitation against default configurations of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0. Exploitation is limited to confidentiality - no write or availability impact. The primary limiting factor is network topology: instances not exposed to untrusted networks (e.g., internal-only deployments behind strict firewalls) are substantially harder to exploit. No specific non-default configuration, feature flag, or platform prerequisite is mentioned in the available data.

The CVSS 3.1 score of 7.5 (High) is consistent with real-world risk for this vulnerability class. The vector AV:N/AC:L/PR:N/UI:N reflects an extremely low exploitation barrier - any unauthenticated attacker with HTTP network access can attempt exploitation without special configuration, user interaction, or elevated privileges. The confidentiality impact is rated High (C:H), meaning full read access to all BI-accessible data, which in enterprise OBIEE deployments typically includes financial reports, HR data, operational metrics, and sensitive executive dashboards. No EPSS data was provided; however, authentication bypass in a widely deployed enterprise analytics platform with a network-exposed HTTP interface represents genuine operational risk, particularly for internet-facing OBIEE instances. No CISA KEV listing and no public POC code have been identified at time of analysis, which moderates urgency somewhat, but the low attack complexity and zero authentication requirement make this a credible target for opportunistic actors following publication of the August 2026 CPU advisory.

An external attacker identifies an internet-facing Oracle BIEE instance on the standard HTTP port, sends a crafted unauthenticated HTTP request to the Analytics Server component that bypasses access control checks, and retrieves sensitive business intelligence data - including financial reports, HR records, or executive dashboards - without ever presenting credentials. No public POC code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation requires minimal tooling once the bypass endpoint is identified.