CVE-2026-71096
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vulnerability in Oracle Business Intelligence Enterprise Edition (component: BI Platform Security) affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker via HTTP, under difficult conditions, can compromise confidentiality and integrity of data, including critical data, and impact other products (scope change).
Risk Assessment
Risk includes unauthorized access to critical data and modification or deletion, potentially leading to loss of confidentiality and integrity across the organization.
Recommendation
Apply Oracle-provided patches for affected versions and restrict HTTP access to trusted users.
Original NVD description (English source)
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).