CVE-2026-91597: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-91597 is a vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of the Oracle Analytics product family. It affects versions 8.2.0.0.0 and 26.01.0.0.0. An unauthenticated attacker with access to the physical communication segment (adjacent network) attached to the hardware running OBIEE can exploit this vulnerability to achieve full system takeover, with a scope change that may impact additional products. It carries a CVSS v3.1 base score of 8.3 (High) (Oracle Advisory, GitHub Advisory). The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update.

The vulnerability resides in the Platform Security component of Oracle Business Intelligence Enterprise Edition and is classified as a network-adjacent, unauthenticated attack with high complexity (CWE information is not listed in available sources). The attack vector requires the attacker to be on the same physical communication segment as the target hardware — such as a local network segment or VLAN — but does not require any credentials or user interaction. The high attack complexity suggests that exploitation requires specific conditions or timing to be met. No CWE classification or detailed technical write-up has been publicly disclosed at this time (Oracle Advisory, GitHub Advisory).

Successful exploitation results in a complete takeover of the Oracle Business Intelligence Enterprise Edition instance, with high impact to confidentiality, integrity, and availability. The scope change (S:C) in the CVSS vector indicates that a successful attack can extend beyond the vulnerable component itself, potentially compromising additional connected products or systems within the environment. This could expose sensitive business intelligence data, allow unauthorized modification of reports and analytics configurations, and disrupt availability of the BI platform (Oracle Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity and requirement for adjacent network access further limit the practical exploitability of this vulnerability.

Oracle has released patches for CVE-2026-91597 as part of the October 2026 Critical Patch Update. Administrators should apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 immediately. As interim mitigations, organizations should restrict physical and logical access to the network segments connected to OBIEE servers, implement network segmentation to isolate the application from untrusted segments, and monitor for unauthorized access attempts to the physical infrastructure. Oracle strongly recommends applying Critical Patch Update patches as soon as possible rather than relying on workarounds (Oracle Advisory).