CVE-2026-21976

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud)

High · published January 20, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

⚡ A low-privilege attacker can easily compromise Oracle Business Intelligence with just a logon! Think of it like a restaurant where anyone with a reservation can walk into the kitchen — they could change the menu, toss out ingredients, or even serve spoiled food without anyone noticing. This vulnerability gives attackers a similar level of access to your critical data. An attacker could gain unauthorized control over your entire Oracle Business Intelligence Enterprise Edition environment. This means they could create, delete, or modify crucial data, which could lead to devastating consequences for your organization — talk about a data disaster!

Put simply

Think of it like a restaurant where anyone with a reservation can walk into the kitchen — they could change the menu, toss out ingredients, or even serve spoiled food without anyone noticing. This vulnerability gives attackers a similar level of access to your critical data. The vulnerability in Oracle Analytics Cloud allows low-privileged attackers with logon access to exploit the system and gain unauthorized access to critical data and operations. Supported versions at risk include 7.6.0.0.0 and 8.2.0.0.0.

What to do

An attacker could gain unauthorized control over your entire Oracle Business Intelligence Enterprise Edition environment. This means they could create, delete, or modify crucial data, which could lead to devastating consequences for your organization — talk about a data disaster! Patch your Oracle Business Intelligence Enterprise Edition to the latest version immediately to avoid exploitation. Review your access controls to ensure that only trusted users have the necessary permissions. Monitor logs for any suspicious activity that might indicate an attack. You've got this! By taking these steps, you can secure your data and keep your environment safe. 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud)
    cvelistv5