Oracle BI Enterprise Edition EUVD-2026-79642

Exploitation requires a low-privileged logon to the infrastructure (operating-system account) on the host where Oracle Business Intelligence Enterprise Edition executes, as stated explicitly in the vendor advisory (CVSS PR:L, AV:L). The attacker must be able to run code or commands in that local session; network reachability to the BI HTTP/WebLogic ports alone is insufficient, since the CVSS vector is local, not adjacent or network. No user interaction is required (UI:N), no special non-default product feature toggle is named in the available data, and complexity is low (AC:L). Limiting factors that reduce real-world exposure: the attacker needs an existing account on the BI host, so organizations that restrict interactive logon on BI servers to a small administrator group and prohibit shared service credentials greatly reduce reachability; conversely, deployments where application owners, database administrators or integrators routinely log on to the BI host give the prerequisite away for free. Authentication requirements are confirmed as low-privileged local (PR:L) from the Oracle-supplied CVSS vector; the specific vulnerable interface or code path is not disclosed.

The consolidated signals are internally consistent but unusually constrained by the local attack vector: a 7.8 base score with PR:L and AV:L means the barrier is not exploit difficulty but the requirement to already hold a logon on the BI host - a meaningful obstacle in hardened single-tenant deployments, and a nearly free step in environments where BI servers are shared with administrators, integrators, ETL operators or jump-host users. There is no EPSS score, no KEV entry, and no reported public exploit code, which suggests this is currently a patch-hygiene issue rather than an ongoing campaign; the absence of an EPSS value should be read as missing data, not as evidence of low exploitation likelihood. Notably, the supplied tag 'Information Disclosure' conflicts with the vendor's own statement that successful attacks result in takeover with high confidentiality, integrity and availability impact - treat the tag as inaccurate and the CVSS/Oracle text as authoritative. Technical impact is total for the BI application (SSVC technical impact: total), exploitation is automatable once a shell exists, and no special user interaction is needed, so even a mid-sized municipal IT team in leszno should treat this as urgent if it runs BI EE hosts shared with non-BI-administrative accounts. Priority should be driven by who can log on to those hosts, not by the headline score.

An attacker who already holds a low-privileged account on a shared host running BI EE 8.2.0.0.0 or 26.01.0.0.0 - for example a contractor, batch operator or compromised service account - exercises the Platform Security weakness locally to escalate to full control of the BI application, then reads and alters reports, data models and credentials and can disable the service. Because the vector is AV:L/AC:L/PR:L/UI:N, the step requires no user interaction or timing; there is no public exploit code reported, so the attacker must develop the technique or use generic post-exploitation tooling. The realistic initial foothold is therefore a phishing-compromised admin workstation, a leaked service credential, or an insider with limited host access.