{"id":"CVE-2026-91535","kind":"vulnerability","aliases":["CVE-2026-91535"],"related":[],"title":"Oracle Business Intelligence: BI Search flaw lets low-privileged users take over server","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Business Intelligence Enterprise Edition has a flaw in the BI Search component, reachable over HTTP. A low-privileged authenticated attacker can take over the product (CVSS 8.8). Oracle fixed it in the October 2026 Critical Patch Update. No exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Business Intelligence Enterprise Edition","fixed":[],"affected":"8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-analytics","oracle-bi","package","self-hosted"],"not_affected_if":["cpu-oct-2026-applied","default-config","managed-hosting"],"how_to_check":"Find your OBIEE version (Help > About, or OPatch lsinventory in the Oracle home). Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected unless the Oct 2026 CPU patch is applied. Oracle does not say BI Search is optional, so assume it is exposed to any user who can log in over HTTP.","fix":"Apply the Oracle Analytics patch from the October 2026 CPU via the My Oracle Support patch availability document (patch numbers need a login; not public). Until then, limit HTTP access to OBIEE to trusted users and review low-privilege accounts.","status":"resolved","published_at":"2026-10-20T22:20:57+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:49+00:00","updated_at":"2026-10-23T23:51:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Business Intelligence: BI Search flaw lets low-privileged users take over server","impact":"high","summary":"Oracle Business Intelligence Enterprise Edition has a flaw in its BI Search component that can be reached over HTTP. An attacker with a low-privilege account on the network can take over the product, with full confidentiality, integrity and availability impact.","category":"package","who_cares":["oracle-analytics","oracle-bi","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the BI server and reads or changes all data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and confirm whether BI Search needs a non-default feature enabled.","how_to_check":"Check the installed Oracle BI version against the affected list: 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0.","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000508,"input_tokens":3116,"output_tokens":393,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and confirm whether BI Search needs a non-default feature enabled.","search":"'-2026':16A,19A '-91535':17A,20A '/av':152C '12.2.1.4.0':101C '2026':72B '26.01.0.0.0':103C '3.1':139C,151C '8.2.0.0.0':100C '8.8':65B,142C 'access':113C 'affect':98C 'allow':107C 'analyt':29B,90C 'attack':58B,110C,124C 'authent':57B 'avail':146C 'base':140C 'bi':4A,32B,47B,92C 'busi':2A,38B,83C,119C,134C 'business':22A 'compon':49B,91C 'compromis':117C 'confidenti':143C 'critic':73B 'cve':15A,18A 'cvss':64B,138C,148C,150C 'easili':104C 'edit':41B,86C,122C,137C 'edition':25A 'enterpris':40B,85C,121C,136C 'enterprise':24A 'exploit':77B,105C 'fix':67B 'flaw':6A,44B 'h':160C 'h/a':159C 'h/i':158C 'host':36B 'http':52B,115C 'impact':147C 'integr':144C 'intellig':3A,39B,84C,120C,135C 'intelligence':23A 'l/pr':154C 'l/ui':155C 'let':7A 'low':9A,55B,108C 'low-privileg':8A,54B 'n/ac':153C 'n/s':156C 'network':112C 'octob':71B 'oracl':1A,26B,28B,31B,37B,66B,82C,89C,118C,133C 'oracle':21A 'oracle-analyt':27B 'oracle-bi':30B 'packag':33B 'patch':74B 'privileg':10A,56B,109C 'product':63B,87C 'reachabl':50B 'report':78B 'result':129C 'score':141C 'search':5A,48B,93C 'self':35B 'self-host':34B 'server':14A 'success':123C 'support':94C 'take':12A,60B 'takeov':131C 'u/c':157C 'updat':75B 'user':11A 'vector':149C 'version':95C 'via':114C 'vulner':79C,106C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91535","severity":null,"published_at":"2026-10-20T22:20:57+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91535:536","url":null,"severity":null,"published_at":"2026-10-23T23:51:51+00:00","modified_at":"2026-10-23T23:51:51+00:00","first_seen_at":"2026-10-23T23:51:51+00:00","fetched_at":"2026-10-23T23:51:51+00:00","note":"Oracle CPU Oct 2026 (20 Oct) covers OBIEE 8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0; CVSS 8.8 from Oracle CNA. Public pages give no fixed version numbers (patch per version is in My Oracle Support doc, login needed). Nothing says BI Search needs a non-default feature, so removed the unsupported default-config tag. No exploitation or PoC in sources; social not searched. Sibling CVE-2026-91241 same product."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2203,"url":"https://cve.armis.com/CVE-2026-91535","title":"CVE-2026-91535 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2204,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-91535/","title":"CVE-2026-91535 Rapid7 DB","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}