Executive brief
Oracle Business Intelligence Enterprise Edition is a reporting and analytics platform used to generate insights from business data. An authenticated attacker with network access can exploit a vulnerability in the Service Administration UI to gain full administrative control over the analytics system, compromising all data and availability of the platform.
Technical details
This is a privilege escalation vulnerability in the Service Administration UI component of Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. The vulnerability is easily exploitable and requires low-privilege network access via HTTP with user authentication (no UI interaction needed). A successful exploit allows an attacker to gain complete control over the Oracle Business Intelligence system, with high impacts to confidentiality, integrity, and availability. Patches or mitigations have not been publicly detailed at this time.
Affected products
- Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
Timeline
- 2026-09-15: disclosed