Oracle Business Intelligence EUVD-2026-79634

Requires network HTTP access to the Oracle Business Intelligence Enterprise Edition Platform Security component and a low-privileged authenticated account (PR:L) - the attacker needs some valid credential/session but not administrative rights. No user interaction is required and attack complexity is low, so exploitation is straightforward once credentials are held. Limiting factors: only version 12.2.1.4.0 is listed as affected, the attacker must already possess low-level access to the BI EE application, and the instance must be network-reachable (internal exposure typical for BI portals reduces but does not eliminate remote reach). The scope change means a successful compromise can extend beyond BI EE to other integrated products.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L - any authenticated BI user account, no admin needed), no user interaction, with a scope change and full confidentiality/integrity/availability impact culminating in product takeover. The scope change (S:C) is the key aggravator, pushing this from a 9.8-equivalent to 9.9 and signaling the compromise breaks out of the BI EE security boundary to affect additional products. However, EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is identified - so there is no evidence of active exploitation. This is characteristic of Oracle Critical Patch Update disclosures, which publish near-zero technical detail (advisory cspusep2026 is a summary page). The signals are internally consistent (network vector matches HTTP delivery in the description; PR:L matches 'low privileged attacker'), so no contradictions to flag; the main gap is total absence of exploitation-probability and technical-detail signals, meaning risk should be judged on the vector plus the low authentication bar rather than on observed exploitation.

An attacker who holds any low-privileged Oracle BI EE account (or has phished/obtained weak credentials) sends crafted HTTP requests to the Platform Security component over the network. Because attack complexity is low and no user interaction is required, the attacker escalates to full takeover of the BI EE instance, and the scope change lets the compromise impact additional connected products. No public exploit code is identified at time of analysis.