Oracle Business Intelligence EUVD-2026-79653

Requires (1) network reachability to the Oracle BI EE web tier over HTTP, and (2) a valid low-privileged Oracle BI EE account - the CVSS vector specifies PR:L, so exploitation is authenticated but not administrative. The vulnerable component is specifically the Service Administration UI of Oracle BI EE 12.2.1.4.0; deployments where that interface is firewalled off from the user population, or where BI accounts are tightly controlled, substantially limit exploitability. No user interaction is required (UI:N) and no non-default configuration toggle is mentioned in the advisory, so the limiting factors are credential possession and network exposure of the Service Administration UI rather than a special feature flag.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack that requires no user interaction and yields complete compromise of the vulnerable component's confidentiality, integrity, and availability, but it does NOT require zero credentials - PR:L means the attacker must already hold a valid low-privileged account. That single prerequisite materially reduces exposure compared with an unauthenticated flaw, though in multi-tenant or externally exposed BI deployments, self-registration or broad user populations can erode that protection. The inputs contain no EPSS score, no CISA KEV entry, and no POC reference, so the exploitation-status signal is 'no public exploit identified at time of analysis' and the real-world likelihood cannot be corroborated by telemetry; the absence of EPSS and KEV data is a gap, not evidence of low risk. The 'Information Disclosure' tag in the input conflicts with the advisory's description of full platform takeover and high integrity/availability impact - treat that tag as unreliable. Net assessment: a genuine high-severity, easily automatable authenticated escalation flaw in an enterprise BI platform; prioritise patching, but it is not a wormable, internet-wide emergency unless the deployment exposes Service Administration UI and grants BI accounts liberally.

An attacker who holds any valid low-privileged Oracle BI EE account authenticates normally to the web interface and then sends crafted HTTP requests directly to the Service Administration UI, bypassing the intended role restriction. Because the exploit is low complexity and requires no user interaction, this can be scripted and repeated across an exposed BI deployment to gain full control of the platform. A public exploit has not been identified at time of analysis, so the attack currently requires the adversary to locate the flaw independently.