{"id":"CVE-2026-87263","kind":"vulnerability","aliases":["CVE-2026-87263"],"related":[],"title":"Oracle Business Intelligence: low-privilege HTTP user can take over server","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Business Intelligence Enterprise Edition (Analytics Server component) 8.2.0.0.0 and 26.01.0.0.0 are affected. Any low-privileged account with HTTP access can take over the instance. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Intelligence Enterprise Edition","fixed":[],"affected":"8.2.0.0.0, 26.01.0.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["obiee","oracle-analytics","oracle-bi","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Find your installed OBIEE/OAS version and check whether it is 8.2.0.0.0 or 26.01.0.0.0 (12.2.1.4.0 is listed in the CPU for other OBIEE CVEs, not this one). Run 'opatch lsinventory' in the BI Oracle home to see whether the October 2026 CPU patch for Oracle Analytics is applied. Check whether the Analytics Server HTTP endpoints are reachable by ordinary users.","fix":"Apply the October 2026 Critical Patch Update for Oracle Analytics. The patch number is in the My Oracle Support patch availability document for Oracle Analytics, linked from the CPU advisory; it is not public, so I have not confirmed a fixed build. Until you patch, limit network access to the BI HTTP endpoints to trusted ranges and review which accounts exist.","status":"open","published_at":"2026-10-20T22:20:05+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:40+00:00","updated_at":"2026-10-24T00:02:59+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:34:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Business Intelligence: low-privilege HTTP user can take over server","impact":"high","summary":"Oracle Business Intelligence Enterprise Edition (Analytics Server component) versions 8.2.0.0.0 and 26.01.0.0.0 are affected. An attacker with a low-privilege account and network access over HTTP can fully take over the instance, with high impact to confidentiality, integrity and availability.","category":"vendor","who_cares":["oracle-analytics","oracle-bi","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the BI server and reads or changes all its data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched build and the exact fixed version for 8.2.0.0.0 and 26.01.0.0.0 (https://nvd.nist.gov/vuln/detail/CVE-2026-87263 links to it).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000517,"input_tokens":3105,"output_tokens":414,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched build and the exact fixed version for 8.2.0.0.0 and 26.01.0.0.0 (https://nvd.nist.gov/vuln/detail/CVE-2026-87263 links to it).","search":"'-2026':14A,17A '-87263':15A,18A '/av':152C '2026':76B '26.01.0.0.0':45B,103C '3.1':62B,139C,151C '8.2.0.0.0':43B,101C '8.8':64B,142C 'access':55B,113C 'account':52B 'affect':47B,99C 'allow':107C 'analyt':27B,40B,91C,93C 'attack':110C,124C 'av':65B 'avail':146C 'base':140C 'bi':30B 'busi':2A,36B,84C,119C,134C 'business':20A 'compon':42B,92C 'compromis':117C 'confidenti':143C 'critic':77B 'cve':13A,16A 'cvss':61B,138C,148C,150C 'easili':104C 'edit':39B,87C,122C,137C 'edition':23A 'enterpris':38B,86C,121C,136C 'enterprise':22A 'exploit':105C 'fix':71B 'h':160C 'h/a':159C 'h/i':158C 'host':33B 'http':7A,54B,115C 'impact':147C 'instanc':60B 'integr':144C 'intellig':3A,37B,85C,120C,135C 'intelligence':21A 'l/pr':67B,154C 'l/ui':68B,155C 'low':5A,50B,108C 'low-privileg':4A,49B 'n':69B 'n/ac':66B,153C 'n/s':156C 'network':112C 'obie':24B 'octob':75B 'oracl':1A,26B,29B,35B,70B,83C,90C,118C,133C 'oracle':19A 'oracle-analyt':25B 'oracle-bi':28B 'patch':78B 'privileg':6A,51B,109C 'product':88C 'result':129C 'score':141C 'self':32B 'self-host':31B 'server':12A,41B,94C 'success':123C 'support':95C 'take':10A,57B 'takeov':131C 'u/c':157C 'updat':79B 'user':8A 'vector':149C 'vendor':34B 'version':96C 'via':114C 'vulner':80C,106C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87263","severity":null,"published_at":"2026-10-20T22:20:05+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87263:573","url":null,"severity":null,"published_at":"2026-10-24T00:02:59+00:00","modified_at":"2026-10-24T00:02:59+00:00","first_seen_at":"2026-10-24T00:02:59+00:00","fetched_at":"2026-10-24T00:02:59+00:00","note":"Oracle CPU Oct 2026 (2026-10-20) lists OBIEE 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 under Oracle Analytics; the CVE record names 8.2.0.0.0 and 26.01.0.0.0 for this CVE. The exact patch number is in a My Oracle Support patch availability note that is not public, so I could not read it. No exploitation or PoC found, and X has 0 posts. Armis calls it unauthenticated, but Oracle's vector is PR:L, so I used Oracle's."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2323,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87263","title":"CVE Record: CVE-2026-87263","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}