CVE-2026-91598: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-91598 is a data disclosure vulnerability in the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of the Oracle Analytics product family. It affects versions 8.2.0.0.0 and 26.01.0.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read access to a subset of OBIEE data. It carries a CVSS v3.1 base score of 4.3 (Medium) (Oracle Advisory, GitHub Advisory). The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update.

The vulnerability resides in the Majel Mobile Service component of Oracle Business Intelligence Enterprise Edition and is classified as a file/data disclosure issue. No specific CWE has been assigned in available sources. The attack vector is network-based over HTTP, requires low privileges (authenticated user), no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated user with HTTP access to the affected component. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory, GitHub Advisory).

Successful exploitation results in unauthorized read access to a subset of data accessible within Oracle Business Intelligence Enterprise Edition. The impact is limited to confidentiality — there is no integrity or availability impact. An attacker could potentially access sensitive business intelligence data, reports, or analytics information they are not authorized to view, which may include proprietary business data depending on the deployment (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has addressed this vulnerability as part of the October 2026 Critical Patch Update (CPU). Organizations should apply the relevant patches for Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 as soon as possible (Oracle Advisory). As an interim measure, Oracle recommends implementing network-level access controls to restrict HTTP access to the Majel Mobile Service component and limiting low-privileged user access until patching is complete. Oracle strongly advises against relying on network-level workarounds as a long-term solution.