CVE-2026-91241

Awaiting Analysis Awaiting Analysis - Queue

Oracle Business Intelligence Enterprise Edition Authentication Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: Oracle

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91241

EUVD

EUVD-2026-106496

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Business Intelligence Enterprise Edition	8.2.0.0.0
Oracle Corporation	Oracle Business Intelligence Enterprise Edition	12.2.1.4.0
Oracle Corporation	Oracle Business Intelligence Enterprise Edition	26.01.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a high-severity vulnerability in Oracle Business Intelligence Enterprise Edition affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a high-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to complete takeover of the Oracle Business Intelligence Enterprise Edition.

Detection Guidance

This vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Detection involves checking for these specific versions and verifying if the Analytics Web Administration component is exposed to HTTP access. No specific commands are provided in the context.

Impact Analysis

An attacker could gain full control over the Oracle Business Intelligence Enterprise Edition, potentially leading to unauthorized access, data theft, or system manipulation. Since attacks may impact additional products, the scope of compromise could extend beyond the primary system.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. A system takeover may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Apply the latest security patches from Oracle for affected versions of Oracle Business Intelligence Enterprise Edition. Restrict network access to the Oracle Business Intelligence Enterprise Edition component via HTTP. Monitor for unusual activity in the Oracle Business Intelligence Enterprise Edition logs.

Hi! I’m here to help you understand CVE-2026-91241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...