---
id: "CVE-2026-91545"
kind: "vulnerability"
aliases: ["CVE-2026-91545"]
title: "Oracle Business Intelligence: Platform Security flaw allows full takeover after user action"
severity: "high"
cvss: 7.8
epss: 0.00159
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-analytics", "oracle-bi", "self-hosted", "vendor"]
not_affected_if: ["no-local-logon", "other-versions"]
published_at: "2026-10-20T22:20:57+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91545", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91545", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Business Intelligence: Platform Security flaw allows full takeover after user action

Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 12.2.1.4.0 contain a flaw in the Platform Security component. An attacker who already has logon access to the host running the product, and who gets a person to take an action, can take over the Business Intelligence installation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed release of Oracle Business Intelligence Enterprise Edition against `8.2.0.0.0` and `12.2.1.4.0`
- Check the Oracle Critical Patch Update advisory listed for CVE-2026-91545 for the affected build list
- unknown for any other check, the sources do not say

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition, the sources do not name the patched version
- unknown for configuration changes, the sources do not say

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91545
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91545

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_