{"id":"CVE-2026-91534","kind":"vulnerability","aliases":["CVE-2026-91534"],"related":[],"title":"Oracle Business Intelligence: unauthenticated web flaw allows data read, change and crash","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).","summary":"Oracle Business Intelligence Enterprise Edition (Analytics Web General) has an easily exploitable flaw reachable over HTTP with no login. It allows limited data read, limited data change, and a hang or repeatable crash. CVSS 8.6. Fixed in Oracle's October 2026 Critical Patch Update.","severity":"high","cvss":8.6,"epss":0.00256,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Intelligence Enterprise Edition","fixed":["October 2026 CPU patch (number unknown)"],"affected":"8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["oracle-analytics","oracle-business-intelligence","self-hosted","vendor"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Find your OBIEE version (for example from Enterprise Manager or the opatch lsinventory output). Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected. Then check whether the October 2026 CPU patch for Oracle Analytics is installed. Also check whether the OBIEE HTTP/HTTPS port is reachable from untrusted networks.","fix":"Apply the October 2026 Critical Patch Update for Oracle Analytics / OBIEE through My Oracle Support. The patch numbers are in the CPU patch availability document, which I could not read. Workaround, from Armis (not from Oracle): restrict network access to the OBIEE HTTP/HTTPS port at the firewall or load balancer.","status":"open","published_at":"2026-10-20T22:20:57+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:39:27+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:39:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Business Intelligence: unauthenticated web flaw allows data read, change and crash","impact":"medium","summary":"Oracle Business Intelligence Enterprise Edition's Analytics Web component has a flaw reachable over HTTP without a login. An attacker can read and change a subset of the data the product can access, and can crash or hang the service repeatedly.","category":"vendor","who_cares":["oracle-analytics","oracle-business-intelligence","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads and modifies some BI data and crashes the service","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched versions of 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and whether a workaround exists.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000511,"input_tokens":3203,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched versions of 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and whether a workaround exists.","search":"'-2026':14A,17A '-91534':15A,18A '/av':197C '12.2.1.4.0':102C '2026':75B '26.01.0.0.0':104C '3.1':184C,196C '8.2.0.0.0':101C '8.6':69B,187C 'abil':132C 'access':113C,157C,166C,171C,181C 'affect':99C 'allow':7A,55B,108C 'analyt':26B,40B,90C,92C 'attack':110C,124C 'avail':191C 'base':185C 'busi':2A,29B,36B,83C,119C,145C,162C,177C 'business':20A 'caus':134C 'chang':10A,61B 'complet':141C 'compon':91C 'compromis':117C 'confidenti':188C 'crash':12A,67B,140C 'critic':76B 'cve':13A,16A 'cvss':68B,183C,193C,195C 'data':8A,57B,60B,167C,182C 'delet':156C 'dos':142C 'easili':45B,105C 'edit':39B,86C,122C,148C,165C,180C 'edition':23A 'enterpris':38B,85C,121C,147C,164C,179C 'enterprise':22A 'exploit':46B,106C 'fix':70B 'flaw':6A,47B 'frequent':138C 'general':42B,94C 'h':205C 'hang':64B,136C 'host':33B 'http':50B,115C 'impact':192C 'insert':154C 'integr':189C 'intellig':3A,30B,37B,84C,120C,146C,163C,178C 'intelligence':21A 'l/a':204C 'l/i':203C 'l/pr':199C 'limit':56B,59B 'login':53B 'n/ac':198C 'n/s':201C 'n/ui':200C 'network':112C 'octob':74B 'oracl':1A,25B,28B,35B,72B,82C,89C,118C,144C,161C,176C 'oracle':19A 'oracle-analyt':24B 'oracle-business-intellig':27B 'patch':77B 'product':87C 'reachabl':48B 'read':9A,58B,170C 'repeat':66B,139C 'result':129C 'score':186C 'self':32B 'self-host':31B 'subset':174C 'success':123C 'support':95C 'u/c':202C 'unauthent':4A,109C 'unauthor':131C,152C,169C 'updat':78B,153C 'vector':194C 'vendor':34B 'version':96C 'via':114C 'vulner':79C,107C,127C 'web':5A,41B,93C 'well':150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91534","severity":null,"published_at":"2026-10-20T22:20:57+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91534:537","url":null,"severity":null,"published_at":"2026-10-23T23:53:05+00:00","modified_at":"2026-10-23T23:53:05+00:00","first_seen_at":"2026-10-23T23:53:05+00:00","fetched_at":"2026-10-23T23:53:05+00:00","note":"Fixed in Oracle CPU Oct 2026 (published 2026-10-20); cve.org gives affected 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0, component Analytics Web General, CVSS 8.6. Exact patch numbers sit in the My Oracle Support patch doc (login needed), not read. No exploitation or PoC found; I did not search social posts."},{"source":"epss","external_id":"CVE-2026-91534","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91534","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2218,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91534","title":"CVE Record: CVE-2026-91534","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2215,"url":"https://cve.armis.com/CVE-2026-91534","title":"CVE-2026-91534 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}