Live › vulnerability › CVE-2026-91534
Go to dashboardOracle Business Intelligence Enterprise Edition (Analytics Web General) has an easily exploitable flaw reachable over HTTP with no login. It allows limited data read, limited data change, and a hang or repeatable crash. CVSS 8.6. Fixed in Oracle's October 2026 Critical Patch Update.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Oracle Business Intelligence Enterprise Edition | vendor | 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 | October 2026 CPU patch (number unknown) |
8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91534")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.