CVE-2026-71095: Oracle BI Enterprise Edition Auth Bypass

CVE-2026-71095 Overview

CVE-2026-71095 is a high-severity access control vulnerability in Oracle Business Intelligence Enterprise Edition (OBIEE), a component of Oracle Analytics. The flaw resides in the BI Platform Security component of version 12.2.1.4.0. A low-privileged attacker with network access over HTTP can exploit the issue without user interaction. Successful exploitation grants unauthorized creation, modification, or deletion of critical data across all OBIEE-accessible data. Attackers can also cause a partial denial of service against the platform. Oracle classified the vulnerability under CWE-284: Improper Access Control.

Critical Impact
An authenticated low-privileged attacker can compromise confidentiality and integrity of all OBIEE-accessible data over the network via HTTP.

Affected Products

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
Oracle Analytics (BI Platform Security component)
Deployments exposing OBIEE HTTP endpoints to authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-71095 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Critical Patch Update, August 2026 - Vendor advisory published in the Oracle Security Alert

Technical Details for CVE-2026-71095

Vulnerability Analysis

The vulnerability affects the BI Platform Security component of OBIEE 12.2.1.4.0. This component enforces authentication, authorization, and access control decisions for BI reports, dashboards, and administrative resources. Improper access control (CWE-284) allows a user with limited privileges to reach functionality or data outside their authorization scope. Because OBIEE aggregates business-critical analytics, the impact extends to reporting content, saved queries, and any dataset accessible through the BI presentation layer. The vulnerability is network-exploitable over HTTP with low attack complexity and requires only low privileges, meaning any authenticated portal user represents a viable attacker.

Root Cause

The root cause is improper access control enforcement in the BI Platform Security component. Oracle's advisory does not disclose the specific code path, but CWE-284 flaws in web analytics platforms typically stem from missing role checks on server-side handlers, inconsistent authorization between REST and SOAP endpoints, or trust in client-supplied identity attributes. Further technical detail is available in the Oracle Security Alert.

Attack Vector

An attacker authenticates to the OBIEE web interface with any low-privileged account. The attacker then issues crafted HTTP requests to functionality that should require higher privileges. The server processes the request without properly validating the caller's authorization, granting read, write, or delete access to protected data. The same request pattern can trigger resource conditions that produce a partial denial of service against BI services.

No verified public proof-of-concept code is available at publication. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-71095

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts to OBIEE administrative or catalog endpoints.
Creation, modification, or deletion of BI catalog objects, reports, or datasets by accounts without a business need.
Repeated authorization failures followed by successful access on the same resource path.
Anomalous spikes in BI server CPU or memory correlated with a single authenticated session.

Detection Strategies

Enable OBIEE audit logging for authentication events, catalog operations, and privileged actions, and forward logs to a centralized analytics platform.
Baseline normal user behavior for report authors versus consumers, and alert on privilege boundary crossings.
Correlate WebLogic access logs with BI catalog write events to identify HTTP requests that bypass expected role gates.

Monitoring Recommendations

Monitor analytics/saw.dll and REST API endpoints under /analytics-ws/ for requests inconsistent with the user's assigned application role.
Track outbound data volumes from OBIEE nodes to detect bulk extraction following exploitation.
Alert on service restarts, thread pool saturation, or JVM errors indicating partial denial of service against the BI server.

How to Mitigate CVE-2026-71095

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert for the August 2026 Critical Patch Update on all OBIEE 12.2.1.4.0 deployments.
Inventory OBIEE user accounts and disable dormant or shared low-privileged accounts that could be leveraged for exploitation.
Restrict network exposure of the OBIEE HTTP interface to trusted network segments and required user populations.
Review BI catalog audit logs for unauthorized create, modify, or delete operations occurring before patching.

Patch Information

Oracle addressed CVE-2026-71095 in the August 2026 Critical Patch Update. Administrators should download and apply the patch bundle referenced in the Oracle Security Alert following Oracle's documented OBIEE patching procedure, including OPatch validation and post-patch service verification.

Workarounds

Place OBIEE behind a reverse proxy or web application firewall that restricts access to catalog and administrative URL paths to specific roles.
Enforce strict application role assignments and remove default privileges from generic authenticated groups until the patch is deployed.
Require multi-factor authentication for all OBIEE users to raise the cost of leveraging a low-privileged foothold.

bash

# Example: verify current OBIEE patch level before and after remediation
cd $ORACLE_HOME/OPatch
./opatch lspatches
./opatch lsinventory -detail | grep -i "Business Intelligence"