Oracle patches critical 9.1 flaw in Business Intelligence Enterprise Edition

Oracle has patched a critical flaw in Oracle Business Intelligence Enterprise Edition that it rates 9.1 under CVSS 3.1, according to its October 2026 Critical Patch Update advisory.

Oracle rates the flaw critical. Oracle, the CNA for CVE-2026-91241, published the record on Oct 20, 2026, with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). NVD has not scored this CVE.

Where the bug sits. The flaw is in the Analytics Web Administration component of Oracle Business Intelligence Enterprise Edition, according to Oracle's risk matrix.

Three versions are affected. Oracle lists supported versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 as affected.

Attackers need high privileges. Oracle says the issue can be exploited over HTTP by a network attacker with high privileges and no user interaction. It is not remotely exploitable without authentication, according to the advisory.

Impact can spread beyond the product. Oracle's scoring marks a scope change, meaning a successful attack could significantly affect other products. Oracle rates the impact on confidentiality, integrity and availability as high, which can amount to takeover of the affected instance.

Fix is available now. Oracle shipped the fix in its October 2026 Critical Patch Update on Oct 20. Oracle says customers should apply Critical Patch Update patches as soon as possible, and administrators running affected versions should do so. Until then, Oracle suggests limiting network access and removing privileges from users who do not need them.

Where to read more. Details are in Oracle's advisory at https://www.oracle.com/security-alerts/cpuoct2026.html.