CVE-2026-91607: 
Oracle Business Intelligence Enterprise Edition (OBIEE) vulnerability analysis and mitigation

CVE-2026-91607 is an information disclosure vulnerability in the Oracle Business Intelligence Enterprise Edition (OBIEE) product of Oracle Analytics, specifically affecting the Analytics Server component. It affects versions 8.2.0.0.0 and 26.01.0.0.0. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.3 (Medium severity) (Oracle CPU Oct 2026, GitHub Advisory).

The vulnerability resides in the Analytics Server component of Oracle Business Intelligence Enterprise Edition and allows a low-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of accessible data. No CWE classification has been formally assigned to this vulnerability. The attack requires valid (low-privilege) credentials but no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has authenticated access to the system (Oracle CPU Oct 2026, GitHub Advisory). No public technical write-ups or proof-of-concept code have been identified at this time.

Successful exploitation results in unauthorized read access to a subset of data accessible within Oracle Business Intelligence Enterprise Edition, constituting a confidentiality impact. There is no impact to integrity or availability. The scope of data exposure is limited to a subset of OBIEE-accessible data rather than full system compromise, and no lateral movement capability has been identified in association with this vulnerability (Oracle CPU Oct 2026, GitHub Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation of CVE-2026-91607 at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Oracle has released patches for CVE-2026-91607 as part of the October 2026 Critical Patch Update, addressing affected versions 8.2.0.0.0 and 26.01.0.0.0 of Oracle Business Intelligence Enterprise Edition. Organizations should apply the relevant patches immediately by following the Oracle Analytics patch availability documentation. As a temporary workaround, restricting network-level HTTP access to the Analytics Server component to authorized users only can reduce exposure until patching is complete (Oracle CPU Oct 2026, GitHub Advisory).