CVE-2026-71094: Oracle OBIEE Auth Bypass Vulnerability

CVE-2026-71094 Overview

CVE-2026-71094 is a high-severity vulnerability in the Presentation Services component of Oracle Business Intelligence Enterprise Edition (OBIEE). The flaw affects supported version 12.2.1.4.0 and enables a low-privileged attacker with local logon access to compromise the OBIEE instance. Successful exploitation requires human interaction from a user other than the attacker. Oracle addressed the issue in the Oracle Security Alert - August 2026. The weakness maps to [CWE-284] Improper Access Control.

Critical Impact
Successful exploitation results in full takeover of Oracle Business Intelligence Enterprise Edition, with high impact to confidentiality, integrity, and availability.

Affected Products

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
Component: Presentation Services
Product family: Oracle Analytics

Discovery Timeline

2026-08-18 - CVE-2026-71094 published to NVD
2026-08-18 - Oracle publishes Security Alert (August 2026)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71094

Vulnerability Analysis

The vulnerability resides in the Presentation Services component of Oracle Business Intelligence Enterprise Edition. Presentation Services renders dashboards, analyses, and reports for OBIEE users and mediates access to underlying analytic content. An attacker with local logon rights and low privileges can leverage the flaw to escalate control over the OBIEE deployment. Exploitation requires a second user to interact with attacker-supplied content, such as opening a crafted link or dashboard object. Once triggered, the interaction chain yields high impact to confidentiality, integrity, and availability, culminating in takeover of the OBIEE instance.

Root Cause

The issue is categorized under [CWE-284] Improper Access Control. Presentation Services does not adequately enforce access restrictions on privileged operations or resources, allowing a low-privileged authenticated user to influence actions performed in another user's context. Oracle has not publicly disclosed the specific code path.

Attack Vector

The attack vector is local. An adversary must first authenticate to the infrastructure hosting OBIEE with at least low-level privileges. The attacker then stages malicious content within Presentation Services and induces a legitimate user to interact with it. That interaction triggers the improper access control condition and results in service takeover.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert - August 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-71094

Indicators of Compromise

Unexpected creation or modification of OBIEE Presentation Services catalog objects (analyses, dashboards, prompts) by low-privileged accounts.
Anomalous session activity where one user's authenticated actions immediately follow another user's link click or dashboard load.
Unusual administrative changes in Presentation Services logs originating from non-administrative user identifiers.

Detection Strategies

Audit Presentation Services sawlog*.log files for privilege-related errors, catalog permission changes, and access to sensitive objects by non-administrators.
Correlate OBIEE web access logs with WebLogic access logs to identify unusual interaction patterns tied to shared dashboard URLs.
Monitor for privilege changes on the OBIEE catalog and unexpected role assignments applied outside of change windows.

Monitoring Recommendations

Ingest OBIEE, WebLogic, and host operating system logs into a centralized analytics platform and alert on deviations from baseline administrator activity.
Track outbound requests initiated from OBIEE servers to identify follow-on activity after suspected takeover.
Alert on new local logons to OBIEE infrastructure hosts by service or low-privileged accounts outside expected patterns.

How to Mitigate CVE-2026-71094

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert - August 2026 to all OBIEE 12.2.1.4.0 deployments.
Inventory all Oracle Analytics installations and confirm patch level against the Oracle advisory.
Restrict local logon rights on OBIEE infrastructure hosts to a minimal set of administrators.
Review Presentation Services catalog permissions and remove excess privileges from standard user accounts.

Patch Information

Oracle released fixes as part of the August 2026 Security Alert cycle. Administrators should download and apply the patch corresponding to Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. Follow Oracle's standard OBIEE patching procedure, which typically requires stopping the OBIEE managed servers, applying the OPatch bundle, and restarting services. Validate that the patch level is reflected in the OBIEE inventory after installation.

Workarounds

Limit interactive and remote logon access to OBIEE hosts until the patch is applied.
Educate OBIEE users to avoid interacting with unsolicited internal links or dashboard content from untrusted colleagues.
Enforce role separation so that authoring privileges in Presentation Services are granted only to vetted content creators.

bash

# Verify installed OBIEE patch level after applying the August 2026 fix
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "Business Intelligence"