{"id":"CVE-2026-91549","kind":"vulnerability","aliases":["CVE-2026-91549"],"related":[],"title":"Oracle Business Intelligence: local flaw lets attacker take over the server","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Business Intelligence Enterprise Edition's Analytics Server component has a flaw that lets an attacker who already has logon on the host take over the product. Exploitation requires a person other than the attacker to take an action.","severity":"high","cvss":7.8,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-analytics","oracle-bi","package","self-hosted"],"not_affected_if":["no-local-logon-exposure"],"how_to_check":"- Check the installed Oracle Business Intelligence version against the affected versions `8.2.0.0.0` and `12.2.1.4.0`\n- Confirm whether local logon to the host running Analytics Server is limited to trusted administrators: unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition on affected versions: unknown (sources do not name the fixed version)","status":"open","published_at":"2026-10-20T22:20:58+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:31+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:08:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition on affected versions: unknown (sources do not name the fixed version)","reach":"local","title":"Oracle Business Intelligence: local flaw lets attacker take over the server","impact":"high","summary":"Oracle Business Intelligence Enterprise Edition's Analytics Server component has a flaw that lets an attacker who already has logon on the host take over the product. Exploitation requires a person other than the attacker to take an action.","category":"package","nicknames":[],"who_cares":["oracle-analytics","oracle-bi","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the BI server, reading and changing its data","analyst_note":"Find the Oracle CPU advisory and the fixed versions for 8.2.0.0.0 and 12.2.1.4.0 at https://nvd.nist.gov/vuln/detail/CVE-2026-91549 and the linked Oracle security alert.","how_to_check":"- Check the installed Oracle Business Intelligence version against the affected versions `8.2.0.0.0` and `12.2.1.4.0`\n- Confirm whether local logon to the host running Analytics Server is limited to trusted administrators: unknown","needs_analyst":true,"not_affected_if":["no-local-logon-exposure"],"who_is_affected":"Teams running Oracle Business Intelligence Enterprise Edition versions `8.2.0.0.0` or `12.2.1.4.0` with the Analytics Server component. The attack needs a local logon on the infrastructure where the product runs, so hosts with tight local access are lower risk. Deployments on other Oracle products or other BI tools are not covered by this entry.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3535,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91549':14A,17A '/av':157C '12.2.1.4.0':90C '3.1':144C,156C '7.8':147C '8.2.0.0.0':88C 'action':66B 'affect':86C 'allow':94C 'alreadi':45B 'analyt':20B,34B,78C,80C 'attack':7A,43B,62B,96C,117C,127C,129C 'avail':151C 'base':145C 'bi':23B 'busi':2A,29B,71C,104C,112C,139C 'compon':36B,79C 'compromis':110C 'confidenti':148C 'cve':12A,15A 'cvss':143C,153C,155C 'easili':91C 'edit':32B,74C,107C,115C,142C 'enterpris':31B,73C,106C,114C,141C 'execut':108C 'exploit':55B,92C 'flaw':5A,39B 'h':165C 'h/a':164C 'h/i':163C 'host':27B,50B 'human':119C 'impact':152C 'infrastructur':101C 'integr':149C 'intellig':3A,30B,72C,105C,113C,140C 'interact':120C 'l/ac':158C 'l/pr':159C 'let':6A,41B 'local':4A 'logon':47B,98C 'n/ui':160C 'oracl':1A,19B,22B,28B,70C,77C,103C,111C,138C 'oracle-analyt':18B 'oracle-bi':21B 'packag':24B 'person':58B,123C 'product':54B,75C 'r/s':161C 'requir':56B,118C 'result':134C 'score':146C 'self':26B 'self-host':25B 'server':11A,35B,81C 'success':116C,128C 'support':82C 'take':8A,51B,64B 'takeov':136C 'u/c':162C 'unauthent':95C 'vector':154C 'version':83C 'vulner':67C,93C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Business Intelligence Enterprise Edition versions `8.2.0.0.0` or `12.2.1.4.0` with the Analytics Server component. The attack needs a local logon on the infrastructure where the product runs, so hosts with tight local access are lower risk. Deployments on other Oracle products or other BI tools are not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91549","severity":null,"published_at":"2026-10-20T22:20:58+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91549","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91549","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}