{"id":"CVE-2026-91597","kind":"vulnerability","aliases":["CVE-2026-91597"],"related":[],"title":"Oracle Business Intelligence: Platform Security flaw allows takeover from adjacent network","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain a Platform Security flaw. An unauthenticated attacker on the physical network segment of the hardware running it can take over the product, with impact reaching other products (CVSS 3.1 8.3).","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle-analytics","oracle-bi","vendor"],"not_affected_if":["other-versions"],"how_to_check":"- Confirm the installed release of Oracle Business Intelligence Enterprise Edition is `8.2.0.0.0` or `26.01.0.0.0`\n- unknown for other checks; the sources do not list specific files or settings","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition; the sources do not name the patched version\n- unknown for further steps","status":"open","published_at":"2026-10-20T22:21:00+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:02:19+00:00","updated_at":"2026-10-25T03:02:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:02:19Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Business Intelligence Enterprise Edition; the sources do not name the patched version\n- unknown for further steps","reach":"network","title":"Oracle Business Intelligence: Platform Security flaw allows takeover from adjacent network","impact":"high","summary":"Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain a Platform Security flaw. An unauthenticated attacker on the physical network segment of the hardware running it can take over the product, with impact reaching other products (CVSS 3.1 8.3).","category":"vendor","nicknames":[],"who_cares":["oracle-analytics","oracle-bi","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the BI server and can affect other products","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched version and the exact adjacent-network conditions; the NVD entry alone does not give them.","how_to_check":"- Confirm the installed release of Oracle Business Intelligence Enterprise Edition is `8.2.0.0.0` or `26.01.0.0.0`\n- unknown for other checks; the sources do not list specific files or settings","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Teams running Oracle Business Intelligence Enterprise Edition on versions 8.2.0.0.0 or 26.01.0.0.0. The attack needs an attacker on the same physical network segment as the host, which limits exposure from the internet. unknown whether other configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3569,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91597':14A,17A '/av':172C '26.01.0.0.0':36B,91C '3.1':66B,159C,171C '8.2.0.0.0':34B,89C '8.3':67B,162C 'a/ac':173C 'access':100C 'addit':139C 'adjac':10A 'affect':87C 'allow':7A,96C 'analyt':23B,79C 'attach':106C 'attack':44B,98C,135C,144C 'avail':166C 'base':160C 'bi':26B 'busi':2A,29B,72C,113C,121C,131C,154C 'c/c':177C 'chang':142C 'communic':104C 'compon':80C 'compromis':119C 'confidenti':163C 'contain':37B 'cve':12A,15A 'cvss':65B,158C,168C,170C 'difficult':92C 'edit':32B,75C,116C,124C,134C,157C 'enterpris':31B,74C,115C,123C,133C,156C 'execut':117C 'exploit':94C 'flaw':6A,41B 'h':180C 'h/a':179C 'h/i':178C 'h/pr':174C 'hardwar':52B,109C 'impact':61B,138C,167C 'integr':164C 'intellig':3A,30B,73C,114C,122C,132C,155C 'may':136C 'n/s':176C 'n/ui':175C 'network':11A,48B 'on-prem':18B 'oracl':1A,22B,25B,28B,71C,78C,112C,120C,130C,153C 'oracle-analyt':21B 'oracle-bi':24B 'physic':47B,103C 'platform':4A,39B,81C 'prem':20B 'product':59B,64B,76C,140C 'reach':62B 'result':149C 'run':53B 'scope':141C 'score':161C 'secur':5A,40B,82C 'segment':49B,105C 'signific':137C 'success':143C 'support':83C 'take':56B 'takeov':8A,151C 'unauthent':43B,97C 'vector':169C 'vendor':27B 'version':33B,84C 'vulner':68C,95C,127C,147C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Business Intelligence Enterprise Edition on versions 8.2.0.0.0 or 26.01.0.0.0. The attack needs an attacker on the same physical network segment as the host, which limits exposure from the internet. unknown whether other configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91597","severity":null,"published_at":"2026-10-20T22:21:00+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}