CVE-2026-60674: Oracle BI Enterprise Auth Bypass Flaw

CVE-2026-60674 Overview

CVE-2026-60674 is a high-severity vulnerability in the Oracle Business Intelligence Enterprise Edition (OBIEE) product of Oracle Analytics, within the BI Platform Security component. The flaw affects supported versions 8.2.0.0.0 and 26.01.0.0.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity. Successful exploitation grants unauthorized access to critical data or complete access to all OBIEE-accessible data, plus unauthorized update, insert, or delete access to a subset of that data.

Critical Impact
Unauthenticated remote attackers can compromise OBIEE over HTTP, exposing critical business intelligence data and permitting limited data modification.

Affected Products

Oracle Business Intelligence Enterprise Edition 8.2.0.0.0
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0
Oracle Analytics BI Platform Security component

Discovery Timeline

2026-07-21 - CVE-2026-60674 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60674

Vulnerability Analysis

The vulnerability resides in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition. Oracle categorizes the flaw as easily exploitable, requiring no authentication, no user interaction, and only network access over HTTP. The impact profile emphasizes confidentiality, with a secondary integrity impact permitting modification of a subset of accessible data. Availability is not affected.

Oracle's published Confidentiality impact of High indicates that an attacker can retrieve any data accessible to OBIEE, which in typical deployments includes sensitive dashboards, reports, and underlying data source connections. The Low Integrity impact reflects partial write access rather than full compromise of stored records.

Because OBIEE is commonly deployed as an enterprise reporting layer with privileged connections to backend databases, exposure of stored credentials, cached datasets, or query metadata materially increases downstream risk to connected data warehouses.

Root Cause

Oracle has not published root cause specifics in the public advisory. The BI Platform Security component handles authentication, authorization, and session enforcement for OBIEE, and the CVSS profile is consistent with a broken access control or authentication bypass class of defect in an HTTP-exposed endpoint.

Attack Vector

Exploitation occurs over the network via HTTP against an OBIEE server reachable by the attacker. No credentials, prior foothold, or victim interaction are required. See the Oracle Security Alert July 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-60674

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to OBIEE endpoints from unexpected source addresses, particularly to analytics/, xmlpserver/, and BI Platform Security URIs.
Anomalous data export volumes, large report downloads, or unexpected query activity originating from the BI application account.
New or modified report objects, subject areas, or catalog entries without a corresponding change ticket.

Detection Strategies

Inventory OBIEE deployments and confirm running versions against the affected list (8.2.0.0.0, 26.01.0.0.0).
Correlate web server access logs with authentication logs to identify successful data access paths that lack a preceding authenticated session.
Alert on HTTP requests to BI endpoints that return large response bodies without an associated authenticated user identifier.

Monitoring Recommendations

Forward OBIEE HTTP access logs, Weblogic server logs, and audit logs to a centralized SIEM for correlation.
Baseline normal query and export volume per user and application account, then alert on statistically significant deviations.
Monitor egress from OBIEE hosts to external destinations to detect data staging or exfiltration.

How to Mitigate CVE-2026-60674

Immediate Actions Required

Apply the fixes from the Oracle Security Alert July 2026 to all affected OBIEE 8.2.0.0.0 and 26.01.0.0.0 instances.
Restrict network exposure of OBIEE HTTP interfaces to trusted management networks and authenticated VPN users.
Rotate credentials used by OBIEE to connect to backend data sources if unauthorized access is suspected.

Patch Information

Oracle published fixes for CVE-2026-60674 as part of the July 2026 Critical Patch Update cycle. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding OBIEE bundle patch for the deployed version. Verify patch application by comparing installed component versions against Oracle's post-patch version listings.

Workarounds

Place OBIEE behind a reverse proxy or web application firewall that enforces authentication before requests reach BI Platform Security endpoints.
Disable or firewall external access to non-essential OBIEE URIs until the patch is deployed.
Limit the data source privileges granted to the OBIEE service account to the minimum required for reporting.

bash

# Example: restrict inbound HTTP access to OBIEE to a management CIDR
iptables -A INPUT -p tcp --dport 9502 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP