Live › vulnerability › CVE-2026-91241
Go to dashboardOracle Business Intelligence Enterprise Edition (Oracle Analytics) has a flaw in the Analytics Web Administration component. A high-privileged attacker with HTTP network access can take over OBIEE, and the scope change means other products can be affected. Oracle fixed it in the October 2026 Critical Patch Update. No exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle Business Intelligence Enterprise Edition | vendor | 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 | – |
8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0 (CVE record writes 26.01.0.0.0) are affected unless the Oct 2026 CPU patch is appliedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91241")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.