Oracle Business Intelligence Enterprise Edition EUVD-2026-79647

Exploitation requires (1) network reachability to the Presentation Services SOAP interface of Oracle BI EE 8.2.0.0.0, 12.2.1.4.0 or 26.01.0.0.0, and (2) a valid low-privileged BI EE account - PR:L in the CVSS vector means the attacker cannot start from an unauthenticated position. Attack complexity is High (AC:H), and Oracle explicitly characterizes the issue as "difficult to exploit", so a working exploit must satisfy specific request-level conditions in Presentation Services; those exact conditions are not disclosed in the available data. No user interaction is required (UI:N). Limiting factors for defenders: unauthenticated users cannot exploit it directly, the endpoint is typically not exposed to the general internet in hardened deployments, and privilege tiers, strong authentication, and reverse-proxy restrictions on SOAP paths all raise the bar. What is NOT required: administrative privileges, local access, or any action by a legitimate user.

Signals are mixed and partly incomplete. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5) confirms a network-reachable, unauthenticated-at-the-network-level but authenticated-at-the-application-level attack requiring a valid low-privileged account, with no user interaction needed and total loss of confidentiality, integrity and availability - a complete platform takeover. However, AC:H and Oracle's own "difficult to exploit" wording materially lower the odds of opportunistic mass exploitation. No EPSS score, KEV status, or POC indicator was provided in the input, so active exploitation is unconfirmed and no public exploit code is known at time of analysis. The supplied tag "Information Disclosure" contradicts the much broader C/I/A impact in the vector and should not be used for triage. Net assessment: high impact, moderate-to-low likelihood - an important patch for internet- or partner-exposed BI EE deployments, but not an emergency unless exposure or a supporting POC emerges. Confirm current EPSS and KEV status independently, since neither was present in the feed.

An attacker who already holds a valid low-privileged BI EE account (or has stolen credentials for one) sends a specially crafted SOAP request to the Presentation Services endpoint that triggers the flawed code path, escaping their assigned role. Because no user interaction is required and the attacker is already inside the application boundary, the escalation can be repeated quietly until full administrative control of the BI instance is achieved. The attack is not trivial: the AC:H rating and Oracle's "difficult to exploit" note indicate specific request construction or state is needed, and no public exploit code is known at time of analysis.