---
id: "CVE-2026-91534"
kind: "vulnerability"
aliases: ["CVE-2026-91534"]
title: "Oracle Business Intelligence: unauthenticated web flaw allows data read, change and crash"
severity: "high"
cvss: 8.6
epss: 0.00256
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Business Intelligence Enterprise Edition", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-analytics", "oracle-business-intelligence", "self-hosted", "vendor"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:20:57+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91534", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:53:05+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91534", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Business Intelligence: unauthenticated web flaw allows data read, change and crash

Oracle Business Intelligence Enterprise Edition (Analytics Web General) has an easily exploitable flaw reachable over HTTP with no login. It allows limited data read, limited data change, and a hang or repeatable crash. CVSS 8.6. Fixed in Oracle's October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Business Intelligence Enterprise Edition affected 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Find your OBIEE version (for example from Enterprise Manager or the opatch lsinventory output). Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected. Then check whether the October 2026 CPU patch for Oracle Analytics is installed. Also check whether the OBIEE HTTP/HTTPS port is reachable from untrusted networks.

## Fix

Apply the October 2026 Critical Patch Update for Oracle Analytics / OBIEE through My Oracle Support. The patch numbers are in the CPU patch availability document, which I could not read. Workaround, from Armis (not from Oracle): restrict network access to the OBIEE HTTP/HTTPS port at the firewall or load balancer.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91534
- 2026-10-23T23:53:05+00:00 analyst — Fixed in Oracle CPU Oct 2026 (published 2026-10-20); cve.org gives affected 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0, component Analytics Web General, CVSS 8.6. Exact patch numbers sit in the My Oracle Support patch doc (login needed), not read. No exploitation or PoC found; I did not search social posts.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91534

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91534 https://www.cve.org/CVERecord?id=CVE-2026-91534
- [mitigation] CVE-2026-91534 Armis https://cve.armis.com/CVE-2026-91534

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_