CVE-2026-91241

Summary

A high-privileged attacker with network access via HTTP can exploit a vulnerability in Oracle Business Intelligence Enterprise Edition's Analytics Web Administration component to achieve full system takeover, affecting confidentiality, integrity, and availability across multiple products due to a scope change.

Exploitability

Easily exploitable by a high-privileged attacker with network access via HTTP; no user interaction required.

Blast radius

Successful exploitation allows full compromise of Oracle Business Intelligence Enterprise Edition and potentially impacts additional products due to the scope change, leading to unauthorized data access, modification, and service disruption.

Detection

Monitor for high-privileged HTTP requests to the Analytics Web Administration endpoint that trigger unexpected administrative actions or privilege escalation patterns in access logs and audit trails.

Prioritized remediation

Upgrade to Oracle Business Intelligence Enterprise Edition version 8.2.0.0.0 Patch Set 12, 12.2.1.4.0 Patch Set 3, or 26.01.0.0.0 or later, as specified in Oracle's Security Alert for CVE-2026-91241.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.