---
id: "CVE-2026-91241"
kind: "vulnerability"
aliases: ["CVE-2026-91241"]
title: "Oracle Business Intelligence: high-privilege attacker can take over the server"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Business Intelligence Enterprise Edition", "fixed": [], "affected": "8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle", "oracle-analytics", "oracle-bi", "package", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "unaffected-versions"]
published_at: "2026-10-20T22:20:24+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:59:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91241", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:59:38+00:00"}]
---

# Oracle Business Intelligence: high-privilege attacker can take over the server

Oracle Business Intelligence Enterprise Edition (Oracle Analytics) has a flaw in the Analytics Web Administration component. A high-privileged attacker with HTTP network access can take over OBIEE, and the scope change means other products can be affected. Oracle fixed it in the October 2026 Critical Patch Update. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Intelligence Enterprise Edition affected 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 fixed ?

## How to check

Check your OBIEE version (e.g. Help > About in Analytics, or OPatch lsinventory in the Oracle home). Versions 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0 (CVE record writes 26.01.0.0.0) are affected unless the Oct 2026 CPU patch is applied. Check whether Analytics Web Administration is reachable over HTTP from untrusted networks.

## Fix

Apply the Oracle Analytics patch from the October 2026 CPU through the My Oracle Support patch availability document (exact patch numbers are behind login; unknown publicly). Until then, restrict network access to Analytics Web Administration to trusted admin IPs and review admin accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91241
- 2026-10-23T22:59:38+00:00 analyst — Oracle CPU Oct 2026 (rev 1, 20 Oct) lists OBIEE 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 under Oracle Analytics patch doc; CVE record (Oracle CNA) CVSS 9.1, component Analytics Web Administration. Public pages give NO fixed version numbers: patch per version is in the My Oracle Support patch availability doc (login needed). NVD page returned empty. No exploitation or PoC found in sources; did not search social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91241 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-91241
- [mentions] CVE-2026-91241 Armis https://cve.armis.com/CVE-2026-91241

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_