How do I check whether I am affected by CVE-2026-91523?

- Check the installed BI version against the affected list: `8.2.0.0.0`, `12.2.1.4.0`, `26.01.0.0.0` - Confirm the deployment is reachable over HTTP from users or networks you do not fully trust

What is the fix for CVE-2026-91523?

- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition on each affected version (exact patch identifier unknown from the sources)

Who is not affected by CVE-2026-91523?

Not affected if: unaffected-version.

Live › vulnerability › CVE-2026-91523

Go to dashboard

medium5.4Vendor

Oracle Business Intelligence: web flaw lets low-privilege users read and change data

Oracle Business Intelligence Enterprise Edition has a flaw in its Analytics Web General component that lets an attacker with a low-privilege account and network access over HTTP read and modify some data the product can access. Exploitation needs a second person to interact with the attack, and the advisory notes it can affect other products beyond BI (scope change).

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads and modifies some BI-accessible data and affects other products.
CVSS said: 5.4. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Teams running Oracle Business Intelligence Enterprise Edition in the affected versions with HTTP access from low-privilege users. The sources do not describe a non-default setting that is required, so default deployments with user logins are the main concern. Installations not running the listed versions can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91523

Go to dashboard

medium5.4Vendor

Oracle Business Intelligence: web flaw lets low-privilege users read and change data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads and modifies some BI-accessible data and affects other products.
CVSS said: 5.4. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Business Intelligence: web flaw lets low-privilege users read and change data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Business Intelligence: web flaw lets low-privilege users read and change data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources