{"id":"CVE-2026-91598","kind":"vulnerability","aliases":["CVE-2026-91598"],"related":[],"title":"Oracle Business Intelligence: Majel Mobile Service flaw exposes some stored data","description":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Business Intelligence Enterprise Edition has a flaw in its Majel Mobile Service component that lets a low-privileged user reach data over HTTP. A successful attack gives unauthorized read access to a subset of the data the BI server can see.","severity":"medium","cvss":4.3,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-analytics","oracle-bi","self-hosted","vendor"],"not_affected_if":["other-versions"],"how_to_check":"- Confirm the installed release: `8.2.0.0.0` and `26.01.0.0.0` are the affected versions named in the description\n- Check whether the Majel Mobile Service component is deployed or reachable on the BI server; the sources do not give a file or setting to look at","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Analytics Business Intelligence Enterprise Edition; the sources do not name the patched version\n- Restrict HTTP access to the BI server to trusted networks until patched","status":"open","published_at":"2026-10-20T22:21:00+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:37:48+00:00","updated_at":"2026-10-25T04:37:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:37:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Analytics Business Intelligence Enterprise Edition; the sources do not name the patched version\n- Restrict HTTP access to the BI server to trusted networks until patched","reach":"network","title":"Oracle Business Intelligence: Majel Mobile Service flaw exposes some stored data","impact":"low","summary":"Oracle Business Intelligence Enterprise Edition has a flaw in its Majel Mobile Service component that lets a low-privileged user reach data over HTTP. A successful attack gives unauthorized read access to a subset of the data the BI server can see.","category":"vendor","nicknames":[],"who_cares":["oracle-analytics","oracle-bi","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads a subset of BI-accessible data","analyst_note":"Check Oracle's CPU advisory for the patched release and whether Majel Mobile Service is on by default.","how_to_check":"- Confirm the installed release: `8.2.0.0.0` and `26.01.0.0.0` are the affected versions named in the description\n- Check whether the Majel Mobile Service component is deployed or reachable on the BI server; the sources do not give a file or setting to look at","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running Oracle Business Intelligence Enterprise Edition in the affected versions where low-privileged users can send HTTP requests to the Majel Mobile Service. The sources do not say whether the mobile service is enabled by default, so teams should confirm before assuming exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3539,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91598':14A,17A '/av':148C '26.01.0.0.0':95C '3.1':138C,147C '4.3':141C '8.2.0.0.0':93C 'access':59B,105C,125C,135C 'affect':91C 'allow':99C 'analyt':20B,82C 'attack':55B,102C,116C 'base':139C 'bi':23B,67B 'busi':2A,29B,75C,111C,131C 'compon':41B,83C 'compromis':109C 'confidenti':142C 'cve':12A,15A 'cvss':137C,144C,146C 'data':11A,50B,65B,136C 'easili':96C 'edit':32B,78C,114C,134C 'enterpris':31B,77C,113C,133C 'exploit':97C 'expos':8A 'flaw':7A,35B 'give':56B 'host':26B 'http':52B,107C 'impact':143C 'intellig':3A,30B,76C,112C,132C 'l/i':154C 'l/pr':150C 'l/ui':151C 'let':43B 'low':46B,100C 'low-privileg':45B 'majel':4A,38B,84C 'mobil':5A,39B,85C 'n':156C 'n/a':155C 'n/ac':149C 'n/s':152C 'network':104C 'oracl':1A,19B,22B,28B,74C,81C,110C,130C 'oracle-analyt':18B 'oracle-bi':21B 'privileg':47B,101C 'product':79C 'reach':49B 'read':58B,124C 'result':121C 'score':140C 'see':70B 'self':25B 'self-host':24B 'server':68B 'servic':6A,40B,86C 'store':10A 'subset':62B,128C 'success':54B,115C 'support':87C 'u/c':153C 'unauthor':57B,123C 'user':48B 'vector':145C 'vendor':27B 'version':88C 'via':106C 'vulner':71C,98C,119C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Business Intelligence Enterprise Edition in the affected versions where low-privileged users can send HTTP requests to the Majel Mobile Service. The sources do not say whether the mobile service is enabled by default, so teams should confirm before assuming exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91598","severity":null,"published_at":"2026-10-20T22:21:00+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91598","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91598","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}