CVE-2026-60671: Oracle BI Enterprise Edition DoS Flaw

CVE-2026-60671 Overview

CVE-2026-60671 is a network-exploitable vulnerability in the Oracle Business Intelligence Enterprise Edition (OBIEE) product within Oracle Analytics. The flaw resides in the BI Platform Security component and affects supported versions 8.2.0.0.0 and 26.01.0.0.0. An unauthenticated attacker with network access over HTTP can exploit this weakness without user interaction. Successful exploitation causes a complete denial of service through service hangs or repeatable crashes. Exploitation also grants unauthorized update, insert, or delete access to a portion of OBIEE data and unauthorized read access to a subset of accessible data.

Critical Impact
Remote unauthenticated attackers can trigger a complete denial of service and tamper with a subset of Oracle Business Intelligence Enterprise Edition data over HTTP.

Affected Products

Oracle Business Intelligence Enterprise Edition 8.2.0.0.0
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0
Component: BI Platform Security

Discovery Timeline

2026-07-21 - CVE-2026-60671 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory (July 2026)

Technical Details for CVE-2026-60671

Vulnerability Analysis

The vulnerability affects the BI Platform Security component of Oracle Business Intelligence Enterprise Edition. It is classified as easily exploitable, requiring no authentication, no privileges, and no user interaction. An attacker sends crafted HTTP requests over the network to reach the vulnerable endpoint. The resulting impact spans confidentiality, integrity, and availability, with a high availability impact that produces a complete denial of service.

Exploitation targets the security handling logic within the BI platform. Successful attacks force the OBIEE service into a hang state or trigger a repeatable crash. Attackers also gain limited write access to backend data, enabling insertion, modification, or deletion of some accessible records. A subset of data is exposed to unauthorized reads during the same attack.

Root Cause

Oracle has not published a detailed root-cause analysis. The advisory identifies the defect within the BI Platform Security component. Because the vulnerability is reachable over HTTP without authentication, the underlying flaw likely involves improper request handling or missing validation in a security-relevant code path. Refer to the Oracle Critical Patch Update Advisory (July 2026) for vendor-issued details.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends malicious HTTP requests to a reachable OBIEE instance. No credentials, tokens, or user interaction are required. Internet-exposed or partner-accessible deployments face the highest exposure. Internal deployments remain exposed to any actor with lateral network reach to the BI service.

No public proof-of-concept or exploit code has been observed at this time. The EPSS score is 0.256% at the 17.163 percentile as of the assessment date, indicating low near-term exploitation probability. This assessment can change quickly if working exploits emerge.

Detection Methods for CVE-2026-60671

Indicators of Compromise

Unexpected OBIEE service hangs, restarts, or crash-loop conditions on the Analytics Server or Presentation Services processes.
Anomalous unauthenticated HTTP requests targeting OBIEE endpoints, especially requests correlating with service disruption.
Unexplained modifications, insertions, or deletions in OBIEE metadata repositories or subject-area data.
Elevated HTTP 5xx error rates or connection timeouts against the BI Platform Security component.

Detection Strategies

Monitor OBIEE application, WebLogic, and reverse-proxy logs for repeated malformed or unusual requests preceding service instability.
Correlate OBIEE process crashes with inbound HTTP traffic in the same time window to identify triggering requests.
Baseline normal request patterns to the BI Platform Security endpoints and alert on statistical deviations.

Monitoring Recommendations

Enable verbose logging on the OBIEE Analytics Server and forward logs to a centralized SIEM or data lake for correlation.
Deploy web application firewall rules to log and rate-limit unauthenticated HTTP requests to OBIEE URLs.
Track service availability, crash counts, and restart events for OBIEE components and alert on threshold breaches.

How to Mitigate CVE-2026-60671

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all OBIEE 8.2.0.0.0 and 26.01.0.0.0 deployments as soon as change windows permit.
Restrict network access to OBIEE endpoints so only trusted networks and users can reach the BI Platform Security component.
Place OBIEE behind a web application firewall or reverse proxy that inspects and filters unauthenticated HTTP traffic.
Review recent OBIEE logs for signs of exploitation attempts or unauthorized data changes prior to patching.

Patch Information

Oracle addressed CVE-2026-60671 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory (July 2026) for patch identifiers, prerequisites, and installation procedures for each supported OBIEE version.

Workarounds

Limit OBIEE exposure by binding the service to internal interfaces and enforcing VPN or zero-trust access controls.
Enforce authentication at an upstream proxy where feasible to block unauthenticated requests reaching OBIEE.
Disable or firewall off external access to the BI Platform Security component until the patch is applied.

bash

# Example: restrict OBIEE HTTP access to trusted management subnet via iptables
iptables -A INPUT -p tcp --dport 9502 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP