CVE-2026-60674: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-60674 is an authentication bypass vulnerability in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of the Oracle Analytics product family. It affects versions 8.2.0.0.0 and 26.01.0.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the affected product, resulting in unauthorized data access and limited data modification. It carries a CVSS v3.1 base score of 8.2 (High), disclosed and patched on July 21, 2026 as part of Oracle's Critical Patch Update (Oracle Advisory).

The vulnerability resides in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition and is classified as an authentication bypass (CWE not explicitly assigned in available sources). It is remotely exploitable over HTTP with no authentication, no user interaction, and low attack complexity required, making it trivially accessible to any network-adjacent attacker. The specific technical mechanism — such as the vulnerable endpoint or bypass method — has not been publicly disclosed by Oracle, consistent with their standard vulnerability disclosure policy (Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to gain complete read access to all data accessible within Oracle Business Intelligence Enterprise Edition, as well as the ability to perform unauthorized insert, update, or delete operations on some accessible data. The confidentiality impact is rated High and the integrity impact Low, with no availability impact. Given that OBIEE typically serves as a reporting and analytics platform with access to sensitive business data, exploitation could expose critical organizational data to unauthorized parties (Oracle Advisory).

Oracle has released patches for CVE-2026-60674 as part of the July 2026 Critical Patch Update (CPU), published July 21, 2026. Affected versions are 8.2.0.0.0 and 26.01.0.0.0; administrators should apply the relevant patches immediately via the Oracle Analytics patch documentation. As a temporary workaround, Oracle recommends restricting network access to the OBIEE application to trusted networks only and implementing network-level controls to limit HTTP exposure. Monitoring authentication logs for anomalous unauthenticated access attempts is also advised until patching is complete (Oracle Advisory).