{"id":"CVE-2026-91241","kind":"vulnerability","aliases":["CVE-2026-91241"],"related":[],"title":"Oracle Business Intelligence: high-privilege attacker can take over the server","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Business Intelligence Enterprise Edition (Oracle Analytics) has a flaw in the Analytics Web Administration component. A high-privileged attacker with HTTP network access can take over OBIEE, and the scope change means other products can be affected. Oracle fixed it in the October 2026 Critical Patch Update. No exploitation reported.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Intelligence Enterprise Edition","fixed":[],"affected":"8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-analytics","oracle-bi","package","runtime","self-hosted"],"not_affected_if":["managed-hosting","unaffected-versions"],"how_to_check":"Check your OBIEE version (e.g. Help > About in Analytics, or OPatch lsinventory in the Oracle home). Versions 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0 (CVE record writes 26.01.0.0.0) are affected unless the Oct 2026 CPU patch is applied. Check whether Analytics Web Administration is reachable over HTTP from untrusted networks.","fix":"Apply the Oracle Analytics patch from the October 2026 CPU through the My Oracle Support patch availability document (exact patch numbers are behind login; unknown publicly). Until then, restrict network access to Analytics Web Administration to trusted admin IPs and review admin accounts.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:18+00:00","updated_at":"2026-10-23T22:59:38+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Business Intelligence: high-privilege attacker can take over the server","impact":"high","summary":"Oracle Business Intelligence Enterprise Edition has a flaw in its Analytics Web Administration component, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker with high privileges over HTTP can take over the product and, because the scope changes, can affect other products as well.","category":"runtime","who_cares":["oracle-analytics","oracle-bi"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the BI server and can reach other products","analyst_note":"Find the patched version for 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 in Oracle's Critical Patch Update advisory, and check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-91241 for the fix and any configuration details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000806,"input_tokens":3163,"output_tokens":979,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the patched version for 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 in Oracle's Critical Patch Update advisory, and check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-91241 for the fix and any configuration details.","search":"'-2026':14A,17A '-91241':15A,18A '/av':180C '12.2.1.4.0':111C '2026':81B '26.01.0.0.0':113C '3.1':167C,179C '8.2.0.0.0':110C '9.1':170C 'access':60B,123C 'addit':147C 'administr':50B,103C 'affect':74B,108C 'allow':117C 'analyt':27B,42B,48B,99C,101C 'attack':7A,56B,120C,143C,152C 'avail':174C 'base':168C 'bi':30B 'busi':2A,37B,92C,129C,139C,162C 'business':20A 'c/c':185C 'chang':68B,150C 'compon':51B,100C 'compromis':127C 'confidenti':171C 'critic':82B 'cve':13A,16A 'cvss':166C,176C,178C 'easili':114C 'edit':40B,95C,132C,142C,165C 'edition':23A 'enterpris':39B,94C,131C,141C,164C 'enterprise':22A 'exploit':86B,115C 'fix':76B 'flaw':45B 'h':188C 'h/a':187C 'h/i':186C 'h/ui':183C 'high':5A,54B,118C 'high-privileg':4A,53B 'host':35B 'http':58B,125C 'impact':146C,175C 'integr':172C 'intellig':3A,38B,93C,130C,140C,163C 'intelligence':21A 'l/pr':182C 'may':144C 'mean':69B 'n/ac':181C 'n/s':184C 'network':59B,122C 'obie':64B 'octob':80B 'oracl':1A,24B,26B,29B,36B,41B,75B,91C,98C,128C,138C,161C 'oracle':19A 'oracle-analyt':25B 'oracle-bi':28B 'packag':31B 'patch':83B 'privileg':6A,55B,119C 'product':71B,96C,148C 'report':87B 'result':157C 'runtim':32B 'scope':67B,149C 'score':169C 'self':34B 'self-host':33B 'server':12A 'signific':145C 'success':151C 'support':104C 'take':9A,62B 'takeov':159C 'updat':84B 'vector':177C 'version':105C 'via':124C 'vulner':88C,116C,135C,155C 'web':49B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91241","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91241:343","url":null,"severity":null,"published_at":"2026-10-23T22:59:38+00:00","modified_at":"2026-10-23T22:59:38+00:00","first_seen_at":"2026-10-23T22:59:38+00:00","fetched_at":"2026-10-23T22:59:38+00:00","note":"Oracle CPU Oct 2026 (rev 1, 20 Oct) lists OBIEE 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 under Oracle Analytics patch doc; CVE record (Oracle CNA) CVSS 9.1, component Analytics Web Administration. Public pages give NO fixed version numbers: patch per version is in the My Oracle Support patch availability doc (login needed). NVD page returned empty. No exploitation or PoC found in sources; did not search social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1714,"url":"https://cve.armis.com/CVE-2026-91241","title":"CVE-2026-91241 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1715,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91241","title":"CVE Record: CVE-2026-91241 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}