EUVD-2026-79653
GHSA-2qm9-v746-2h9m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web flaw requiring only a valid low-privileged account (PR:L) with no user interaction and total CIA loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Service Administration UI). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) network reachability to the Oracle BI EE web tier over HTTP, and (2) a valid low-privileged Oracle BI EE account - the CVSS vector specifies PR:L, so exploitation is authenticated but not administrative. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack that requires no user interaction and yields complete compromise of the vulnerable component's confidentiality, integrity, and availability, but it does NOT require zero credentials - PR:L means the attacker must already hold a valid low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html, which is the vendor-referenced fix for this issue; Oracle CPU advisories typically ship a bundled patch, so validate the exact patched build against the advisory before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today