CVE-2026-71122 Overview
CVE-2026-71122 is a high-severity vulnerability in the Oracle Business Intelligence Enterprise Edition (OBIEE) product of Oracle Analytics. The flaw resides in the Platform Security component and affects version 26.01.0.0.0. Exploitation requires network access via HTTP and high privileges on the target system. Successful exploitation results in complete takeover of Oracle Business Intelligence Enterprise Edition. The vulnerability includes a scope change, meaning attacks may significantly impact additional products beyond OBIEE itself. Oracle addressed the issue in the Oracle Security Alert CSPUAUG2026.
Critical Impact
Successful attacks result in full compromise of confidentiality, integrity, and availability of Oracle Business Intelligence Enterprise Edition, with potential impact on connected products through scope change.
Affected Products
- Oracle Business Intelligence Enterprise Edition 26.01.0.0.0
- Oracle Analytics (Platform Security component)
- Downstream Oracle products connected to affected OBIEE deployments (scope change)
Discovery Timeline
- 2026-08-18 - CVE-2026-71122 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-71122
Vulnerability Analysis
The vulnerability affects the Platform Security component of Oracle Business Intelligence Enterprise Edition. It maps to [CWE-284: Improper Access Control], indicating that authorization or access enforcement logic fails to correctly restrict privileged operations. An authenticated attacker with high privileges can send crafted HTTP requests to abuse this access control weakness. The scope change designation indicates that the impacted resources extend beyond the vulnerable component's security authority. This allows attackers to affect additional connected Oracle products once OBIEE is compromised. Exploitation complexity is high, requiring specific conditions beyond attacker control to reliably succeed.
Root Cause
The root cause is improper access control (CWE-284) within the Platform Security subsystem of OBIEE 26.01.0.0.0. The component fails to properly enforce authorization boundaries for privileged HTTP-accessible operations. Because Platform Security governs authentication and authorization decisions across OBIEE, its compromise cascades into full product takeover.
Attack Vector
The attack vector is network-based over HTTP. An attacker must already hold high privileges within the target OBIEE environment before attempting exploitation. No user interaction is required. Once the access control weakness is triggered, the attacker gains full control of OBIEE and can pivot to impact connected Oracle Analytics components. Oracle has not published exploitation details, and no public proof-of-concept exploit is available. Refer to the Oracle Security Alert CSPUAUG2026 for vendor guidance.
Detection Methods for CVE-2026-71122
Indicators of Compromise
- Unexpected HTTP requests to OBIEE Platform Security endpoints originating from privileged accounts.
- Unauthorized configuration changes to OBIEE authentication, authorization, or role mappings.
- New or modified administrative sessions in OBIEE audit logs that do not correlate with change management records.
- Anomalous outbound requests from OBIEE hosts to other Oracle Analytics or backend components.
Detection Strategies
- Monitor OBIEE audit logs for privileged administrative operations invoked over HTTP, especially those affecting Platform Security configuration.
- Correlate authentication events with configuration changes to identify privileged sessions that perform sensitive operations shortly after login.
- Baseline normal Platform Security API activity and alert on deviations in request volume, source addresses, or accessed endpoints.
Monitoring Recommendations
- Ingest OBIEE, WebLogic, and Oracle HTTP Server logs into a centralized SIEM for correlation across the analytics stack.
- Enable verbose auditing on OBIEE Platform Security actions and retain logs long enough to support incident review.
- Alert on lateral movement patterns from OBIEE hosts toward connected Oracle systems, consistent with the scope change described in the CVE.
How to Mitigate CVE-2026-71122
Immediate Actions Required
- Apply the fixes referenced in the Oracle Security Alert CSPUAUG2026 to all affected OBIEE 26.01.0.0.0 deployments.
- Inventory privileged OBIEE accounts and revoke or rotate credentials for any that are unused, shared, or over-privileged.
- Restrict network access to OBIEE administrative HTTP endpoints so that only trusted management networks can reach them.
- Review audit logs for suspicious privileged activity dating back to the earliest possible exposure window.
Patch Information
Oracle has published mitigation guidance in Oracle Security Alert CSPUAUG2026. Administrators should apply the referenced updates for Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 as soon as maintenance windows allow. No exploit is publicly available at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Workarounds
- Enforce the principle of least privilege for OBIEE roles and reduce the number of accounts holding administrative rights.
- Place OBIEE administrative interfaces behind a reverse proxy or web application firewall with strict allow-listing.
- Require multi-factor authentication for all privileged OBIEE administrative access to raise the bar for account compromise.
- Segment OBIEE hosts from other Oracle Analytics components to limit blast radius from the scope change condition.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
