CVE-2026-91588: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-91588 is a tampering vulnerability in the BI Search component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of the Oracle Analytics product family. It affects versions 8.2.0.0.0 and 12.2.1.4.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires human interaction from a person other than the attacker. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory, GitHub Advisory). The vulnerability was disclosed as part of Oracle's October 2026 Critical Patch Update, published on October 20, 2026 (Oracle Advisory).

The vulnerability resides in the BI Search component of Oracle Business Intelligence Enterprise Edition and is classified as a tampering/integrity-impact issue. No specific CWE classification has been assigned in available sources. The attack vector is network-based over HTTP with low attack complexity and no privileges required, but user interaction is necessary — consistent with a social engineering or cross-site request forgery (CSRF)-style attack pattern where a victim must interact with a malicious resource. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Oracle Advisory, GitHub Advisory). Oracle has not publicly disclosed further technical details about the root cause or specific exploitation mechanics.

Successful exploitation allows an unauthenticated attacker to perform unauthorized creation, deletion, or modification of critical data or all data accessible within Oracle Business Intelligence Enterprise Edition. There is no confidentiality or availability impact — the risk is entirely to data integrity. This could result in corruption or manipulation of business intelligence data, reports, or search indexes, potentially affecting business decision-making processes that rely on OBIEE data (Oracle Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported in connection with this CVE.

Oracle has addressed this vulnerability as part of the October 2026 Critical Patch Update. Affected organizations should apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 12.2.1.4.0 as soon as possible (Oracle Advisory). As a temporary measure, Oracle recommends restricting network access to OBIEE to authorized users and networks only, and blocking HTTP access from untrusted sources. User awareness training to prevent interaction with untrusted links or content may also reduce risk, given the user-interaction requirement for exploitation. Oracle strongly advises against relying on workarounds as a long-term solution.