CVE-2026-91600: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-91600 is an information disclosure vulnerability in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of the Oracle Analytics product family. The affected version is 26.01.0.0.0. A low-privileged attacker with network access via HTTP can exploit this easily exploitable vulnerability to gain unauthorized read access to a subset of OBIEE accessible data. It was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update, with a CVSS v3.1 base score of 4.3 (Medium) (Oracle CPU Oct 2026, GitHub Advisory).

The vulnerability resides in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0. It is exploitable over the network via HTTP by a low-privileged authenticated user, requiring no user interaction and no elevated privileges beyond a basic account. No CWE classification has been assigned, and Oracle has not publicly disclosed the specific root cause or technical mechanism of the flaw. The vulnerability results solely in confidentiality impact, with no integrity or availability consequences (Oracle CPU Oct 2026, GitHub Advisory).

Successful exploitation allows a low-privileged attacker to read a subset of data accessible within Oracle Business Intelligence Enterprise Edition that they are not authorized to access, constituting an unauthorized information disclosure. There is no impact on data integrity or system availability. The scope of exposed data is limited to what is accessible within the OBIEE environment, but could include sensitive business analytics, reports, or underlying data depending on the deployment (Oracle CPU Oct 2026).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has addressed this vulnerability as part of the October 2026 Critical Patch Update. Organizations should apply the relevant patches for Oracle Business Intelligence Enterprise Edition as soon as possible. As a temporary measure, Oracle recommends restricting network access to OBIEE to authorized users only, implementing network segmentation, and monitoring access logs for anomalous data access attempts. Oracle strongly advises against relying on network-level workarounds as a long-term solution (Oracle CPU Oct 2026).