---
id: "CVE-2026-91549"
kind: "vulnerability"
aliases: ["CVE-2026-91549"]
title: "Oracle Business Intelligence: local flaw lets attacker take over the server"
severity: "high"
cvss: 7.8
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["oracle-analytics", "oracle-bi", "package", "self-hosted"]
not_affected_if: ["no-local-logon-exposure"]
published_at: "2026-10-20T22:20:58+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91549", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91549", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Business Intelligence: local flaw lets attacker take over the server

Oracle Business Intelligence Enterprise Edition's Analytics Server component has a flaw that lets an attacker who already has logon on the host take over the product. Exploitation requires a person other than the attacker to take an action.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Business Intelligence version against the affected versions `8.2.0.0.0` and `12.2.1.4.0`
- Confirm whether local logon to the host running Analytics Server is limited to trusted administrators: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition on affected versions: unknown (sources do not name the fixed version)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91549
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91549

## From the sources

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_