CVE-2026-71099: Oracle BI Enterprise Edition Privilege Escalation

CVE-2026-71099 Overview

CVE-2026-71099 is a high-severity access control vulnerability [CWE-284] in the Oracle Business Intelligence Enterprise Edition (OBIEE) product of Oracle Analytics. The flaw resides in the Analytics Web Answers component of version 26.01.0.0.0. An authenticated attacker with high privileges and network access via HTTP can exploit the weakness to fully compromise the affected instance. Oracle disclosed the issue in the Oracle Security Alert August 2026. The vulnerability affects the confidentiality, integrity, and availability of the target system.

Critical Impact
Successful exploitation results in complete takeover of the affected Oracle Business Intelligence Enterprise Edition instance, exposing analytics data and reporting infrastructure to compromise.

Affected Products

Oracle Business Intelligence Enterprise Edition 26.01.0.0.0
Oracle Analytics — Analytics Web Answers component
Oracle Analytics deployments incorporating the affected OBIEE release

Discovery Timeline

2026-08-18 - CVE-2026-71099 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71099

Vulnerability Analysis

The vulnerability exists in the Analytics Web Answers component of Oracle Business Intelligence Enterprise Edition. The Web Answers component provides ad hoc query and analysis capabilities to authenticated users through the OBIEE web interface. Improper access control [CWE-284] in this component allows a high-privileged attacker operating over HTTP to escalate access and take over the OBIEE instance.

Oracle classifies the flaw as easily exploitable once the attacker possesses the required privileges. The attack requires no user interaction and executes over the network. Impact spans all three security properties: confidentiality of analytics data, integrity of reports and configuration, and availability of the reporting service.

Root Cause

The root cause is an access control weakness [CWE-284] in the Analytics Web Answers component. Oracle has not disclosed the specific code path in the public advisory. The design or implementation flaw permits privileged operations without enforcing the expected authorization boundaries, enabling a legitimate high-privileged user to escalate to full product takeover.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker with high privileges on OBIEE 26.01.0.0.0 sends crafted HTTP requests to the Analytics Web Answers component. Because the attack complexity is low and no user interaction is required, exploitation is straightforward for any actor holding the necessary account. Refer to the Oracle Security Alert August 2026 for vendor-specific technical detail.

Detection Methods for CVE-2026-71099

Indicators of Compromise

Unexpected administrative or configuration changes performed by high-privileged OBIEE accounts against the Analytics Web Answers component.
Anomalous HTTP requests to Web Answers endpoints originating from accounts that do not typically perform analytics authoring.
Creation of new privileged users, altered role mappings, or modified catalog objects outside of change windows.

Detection Strategies

Enable and forward OBIEE audit logs, WebLogic access logs, and Analytics Web Answers activity to a central log platform for correlation.
Baseline normal Web Answers usage per privileged account and alert on deviations in request volume, endpoints touched, or timing.
Correlate authentication events with subsequent privileged Web Answers actions to identify credential misuse or session takeover.

Monitoring Recommendations

Monitor for the OBIEE version string 26.01.0.0.0 in asset inventory and prioritize monitoring on those instances until patched.
Track outbound network activity from OBIEE servers for signs of data exfiltration following administrative actions.
Review privileged account inventories and remove dormant or unnecessary high-privileged OBIEE accounts.

How to Mitigate CVE-2026-71099

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert August 2026 to all affected OBIEE 26.01.0.0.0 instances.
Audit and reduce the number of accounts holding high-privileged roles in OBIEE, and enforce multi-factor authentication for those accounts.
Rotate credentials for privileged OBIEE and WebLogic accounts if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-71099 in the August 2026 security alert cycle. Administrators should download and apply the fix documented in the Oracle Security Alert August 2026 following Oracle's standard patch procedures for Fusion Middleware components. Validate the patch in a non-production environment before rolling to production and confirm the OBIEE build number after installation.

Workarounds

Restrict network access to OBIEE Analytics Web Answers endpoints to trusted management networks using firewall or reverse-proxy rules.
Apply least-privilege to OBIEE roles and remove Web Answers authoring privileges from accounts that do not require them.
Place the OBIEE web tier behind a web application firewall configured to log and rate-limit administrative request patterns until the patch is applied.

bash

# Configuration example: restrict access to OBIEE Analytics Web Answers at the reverse proxy
# (Adjust CIDR ranges and paths to match your environment)
location /analytics/saw.dll {
    allow 10.0.0.0/8;      # trusted management network
    deny  all;
    proxy_pass http://obiee-backend;
}