CVE-2026-71094: High severity Oracle Oracle Business Intelligence Enterprise Edition vulnerability
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Business Intelligence Enterprise Edition (Oracle Analytics) - Presentation Servicesto a version that resolves this vulnerability.Fixed in 12.2.1.4.0
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Business Intelligence Enterprise Edition deployments running the affected supported version, 12.2.1.4.0, are exposed. Exploitation requires access to the infrastructure where the product executes and a low-privileged authenticated account.
Can this be exploited remotely without credentials?
No. The CVSS vector identifies local attack access and low privileges as required, so an attacker must be able to log on to the affected infrastructure with a low-privileged account.
Does exploitation require user interaction?
Yes. A person other than the attacker must interact as part of a successful attack.
What is the potential impact of a successful exploit?
A successful attack can result in takeover of Oracle Business Intelligence Enterprise Edition, with high impacts to confidentiality, integrity, and availability.