---
id: "CVE-2026-87263"
kind: "vulnerability"
aliases: ["CVE-2026-87263"]
title: "Oracle Business Intelligence: low-privilege HTTP user can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Business Intelligence Enterprise Edition", "fixed": [], "affected": "8.2.0.0.0, 26.01.0.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["obiee", "oracle-analytics", "oracle-bi", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:05+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:02:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87263", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:02:59+00:00"}]
---

# Oracle Business Intelligence: low-privilege HTTP user can take over server

Oracle Business Intelligence Enterprise Edition (Analytics Server component) 8.2.0.0.0 and 26.01.0.0.0 are affected. Any low-privileged account with HTTP access can take over the instance. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Intelligence Enterprise Edition affected 8.2.0.0.0, 26.01.0.0.0 fixed ?

## How to check

Find your installed OBIEE/OAS version and check whether it is 8.2.0.0.0 or 26.01.0.0.0 (12.2.1.4.0 is listed in the CPU for other OBIEE CVEs, not this one). Run 'opatch lsinventory' in the BI Oracle home to see whether the October 2026 CPU patch for Oracle Analytics is applied. Check whether the Analytics Server HTTP endpoints are reachable by ordinary users.

## Fix

Apply the October 2026 Critical Patch Update for Oracle Analytics. The patch number is in the My Oracle Support patch availability document for Oracle Analytics, linked from the CPU advisory; it is not public, so I have not confirmed a fixed build. Until you patch, limit network access to the BI HTTP endpoints to trusted ranges and review which accounts exist.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87263
- 2026-10-24T00:02:59+00:00 analyst — Oracle CPU Oct 2026 (2026-10-20) lists OBIEE 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 under Oracle Analytics; the CVE record names 8.2.0.0.0 and 26.01.0.0.0 for this CVE. The exact patch number is in a My Oracle Support patch availability note that is not public, so I could not read it. No exploitation or PoC found, and X has 0 posts. Armis calls it unauthenticated, but Oracle's vector is PR:L, so I used Oracle's.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-87263 https://www.cve.org/CVERecord?id=CVE-2026-87263

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_