CVE-2026-91241 is a critical (CVSS 9.1) vulnerability in the Analytics Web Administration component of Oracle Business Intelligence Enterprise Edition that a high-privileged attacker can exploit over HTTP to take over the product.
What Is It
CVE-2026-91241 affects Oracle Business Intelligence Enterprise Edition, part of Oracle Analytics, in the Analytics Web Administration component. Oracle describes it as "easily exploitable." An attacker who has high privileges and network access over HTTP can use it to compromise the product.
The scope is marked as changed. That means the flaw sits in Oracle Business Intelligence Enterprise Edition, but a successful attack may significantly affect other products too. Oracle says a successful attack can result in full takeover of Oracle Business Intelligence Enterprise Edition.
NVD published the record on October 20, 2026. Its status is currently "Received," so NVD has not yet completed its own analysis.
Why It Matters
Oracle rates the flaw 9.1 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: High
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability impact
The main limit on exploitation is that the attacker needs high privileges. Still, low complexity, no required user interaction and a changed scope together mean that a compromised or malicious admin-level account could reach well beyond the BI platform itself.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE, so KEV does not confirm active exploitation at this time.
What's Vulnerable
Oracle lists these supported versions of Oracle Business Intelligence Enterprise Edition as affected:
- 8.2.0.0.0
- 12.2.1.4.0
- 26.01.0.0.0
The NVD record contains no affected CPE entries yet.
Patch Status
The NVD record references Oracle's October 2026 Critical Patch Update advisory, where Oracle published this vulnerability. Administrators running any affected version should check that advisory for fix and remediation guidance and apply it.
Because no KEV entry exists, CISA has issued no required action or remediation due date for this CVE. Until patching is done, organizations should consider reviewing which accounts hold high privileges on their Oracle BI deployments and limiting HTTP access to the Analytics Web Administration component.
Sources
- NVD, CVE-2026-91241
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)