Oracle Business Intelligence EUVD-2026-79635

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Platform Security component). The only stated prerequisite is network reachability of the BI EE HTTP interface; no authentication, user interaction, or non-default configuration is required (PR:N/UI:N/AC:L). Limiting factors: exposure is confined to the single affected release 12.2.1.4.0, and real-world reach depends on whether the BI server's HTTP endpoint is accessible to the attacker (internet-facing instances are at highest risk; internal-only deployments reduce exposure).

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes an unauthenticated, network-reachable, low-complexity attack with no user interaction that yields full compromise of confidentiality, integrity and availability - consistent with the description's 'takeover.' The CWE-287 (authentication bypass) classification aligns cleanly with the PR:N metric. CISA's SSVC framework reinforces this: Technical Impact 'total' and Automatable 'yes' mean a working exploit could be scripted at scale. The one signal that tempers urgency is SSVC Exploitation 'none' - there is no evidence of exploitation, no CISA KEV listing, no public POC, and no EPSS score provided, so this is not confirmed under active attack. The picture is therefore a high-capability, low-friction bug that is dangerous by construction but, as of this analysis, only theoretically exploited. There is no metric conflict: description ('unauthenticated', 'network', 'HTTP', 'takeover') and CVSS vector agree. Note this is the pre-auth S:U sibling of CVE-2026-83282 (same product/component, PR:L/S:C, 9.9); despite requiring no privileges, its unchanged scope keeps it at 9.8 rather than higher.

A remote attacker with no credentials sends a crafted HTTP request to an internet- or intranet-exposed Oracle BI Enterprise Edition 12.2.1.4.0 Platform Security endpoint, bypassing authentication to gain full control of the BI server and its data. Because SSVC rates the attack Automatable=yes with total technical impact, a reliable exploit could be mass-scanned and weaponized against exposed instances. No public exploit code has been identified at time of analysis.