EUVD-2026-79642
GHSA-3ghv-crrv-fmc3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vector is local with low complexity and low privileges, matching the vendor statement that a logon on the BI host is required; impacts are high across C/I/A with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged logon to the infrastructure (operating-system account) on the host where Oracle Business Intelligence Enterprise Edition executes, as stated explicitly in the vendor advisory (CVSS PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The consolidated signals are internally consistent but unusually constrained by the local attack vector: a 7.8 base score with PR:L and AV:L means the barrier is not exploit difficulty but the requirement to already hold a logon on the BI host - a meaningful obstacle in hardened single-tenant deployments, and a nearly free step in environments where BI servers are shared with administrators, integrators, ETL operators or jump-host users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update fixes for Business Intelligence Enterprise Edition as published at https://www.oracle.com/security-alerts/cspusep2026.html; no specific patched version string is given in the source data, so the exact target build must be taken from that advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today