{ "cve": "CVE-2026-71061", "enrichment": { "affected": [ { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "generic", "value": "8.2.0.0.0" } }, { "platform": null, "status": "affected", "versions": { "scheme": "generic", "value": "26.01.0.0.0" } } ], "enrichment": { "confidence": 95.0, "confidence_source": "inferred", "scores": [ { "score": 95.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Oracle Business Intelligence Enterprise Edition", "source": "cna", "vendor": "Oracle Corporation" }, "product": "business_intelligence", "vendor": "oracle" } ], "created": "2026-08-19T08:00:04.597401+00:00", "title": "Unauthorized HTTP Access Enables Full Data Exposure in Oracle Business Intelligence Enterprise Edition", "updated": "2026-08-20T23:15:05.196228+00:00", "vendors": [ "oracle", "oracle$PRODUCT$business_intelligence" ] }, "epss": { "score": 0.00414 }, "mitre": { "cpes": [ "cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*", "cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*" ], "created": "2026-08-18T21:03:18.369000+00:00", "description": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "cvssV4_0": {} }, "mitre_repo_path": "cves/2026/71xxx/CVE-2026-71061.json", "references": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "title": null, "updated": "2026-09-17T18:41:31.059000+00:00", "vendors": [ "oracle", "oracle$PRODUCT$business_intelligence" ], "weaknesses": [] }, "nvd": { "cpes": [ "cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*", "cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*" ], "created": "2026-08-18T21:18:05.967000+00:00", "description": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "cvssV4_0": {} }, "nvd_repo_path": "2026/CVE-2026-71061.json", "references": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "title": null, "updated": "2026-08-24T15:54:34.700000+00:00", "vendors": [ "oracle", "oracle$PRODUCT$business_intelligence" ], "weaknesses": [ "CWE-284" ] }, "opencve": { "changes": [ { "created": "2026-08-18T21:15:00+00:00", "data": [ { "details": { "new": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "old": null }, "type": "description" }, { "details": [ "oracle", "oracle$PRODUCT$business_intelligence" ], "type": "first_time" }, { "details": { "added": [ "cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*", "cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*" ], "removed": [] }, "type": "cpes" }, { "details": { "added": [ "oracle", "oracle$PRODUCT$business_intelligence" ], "removed": [] }, "type": "vendors" }, { "details": { "added": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "removed": [] }, "type": "references" }, { "details": { "added": { "cvssV3_1": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "a78f4ac0-9252-435f-b1e0-cd40de9c0898" }, { "created": "2026-08-19T08:15:00+00:00", "data": [ { "details": { "new": "Unauthenticated HTTP Remote Access Leading to Full Data Access in Oracle Business Intelligence Enterprise Edition", "old": null }, "type": "title" }, { "details": { "added": [ "CWE-284", "CWE-306" ], "removed": [] }, "type": "weaknesses" } ], "id": "d3dfa0e3-eb66-45b0-baaf-2190a91a9702" }, { "created": "2026-08-19T22:45:00+00:00", "data": [ { "details": { "new": null, "old": "Unauthenticated HTTP Remote Access Leading to Full Data Access in Oracle Business Intelligence Enterprise Edition" }, "type": "title" }, { "details": { "added": [], "removed": [ "CWE-306" ] }, "type": "weaknesses" } ], "id": "bb98415a-ca11-4de7-b1a7-6fbf487c3772" }, { "created": "2026-08-20T23:30:00+00:00", "data": [ { "details": { "new": "Unauthorized HTTP Access Enables Full Data Exposure in Oracle Business Intelligence Enterprise Edition", "old": null }, "type": "title" } ], "id": "74aefd3b-0a63-498d-bb0f-3546775ce344" }, { "created": "2026-09-17T19:30:00+00:00", "data": [ { "details": { "added": { "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "e6ba18a5-c23b-41d4-b1b0-01880300a629" } ], "cpes": { "data": [ "cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*", "cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*" ], "providers": [ "mitre", "nvd" ] }, "created": { "data": "2026-08-18T21:03:18.369000+00:00", "provider": "mitre" }, "description": { "data": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "provider": "mitre" }, "metrics": { "cvssV2_0": { "data": {}, "provider": null }, "cvssV3_0": { "data": {}, "provider": null }, "cvssV3_1": { "data": { "score": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "provider": "mitre" }, "cvssV4_0": { "data": {}, "provider": null }, "epss": { "data": { "score": 0.00414 }, "provider": "first" }, "kev": { "data": {}, "provider": null }, "ssvc": { "data": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" }, "provider": "vulnrichment" }, "threat_severity": { "data": null, "provider": null } }, "references": { "data": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "providers": [ "mitre", "nvd" ] }, "title": { "data": "Unauthorized HTTP Access Enables Full Data Exposure in Oracle Business Intelligence Enterprise Edition", "provider": "enrichment" }, "updated": { "data": "2026-09-17T18:41:31.059000+00:00", "provider": "mitre" }, "vendors": { "data": [ "oracle", "oracle$PRODUCT$business_intelligence" ], "providers": [ "mitre", "nvd", "enrichment" ] }, "weaknesses": { "data": [ "CWE-284" ], "providers": [ "nvd", "vulnrichment" ] } }, "vulnrichment": { "cpes": [], "created": "2026-08-18T21:03:18.369000+00:00", "description": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": {}, "cvssV4_0": {}, "kev": {}, "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "references": [], "title": null, "updated": "2026-08-19T15:48:59.041000+00:00", "vendors": [], "vulnrichment_repo_path": "2026/71xxx/CVE-2026-71061.json", "weaknesses": [ "CWE-284" ] } }