CVE-2026-21976
Oracle Business Intelligence 7.6.0.0.0 … 8.2.0.0.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-21976 is a high-severity an unspecified weakness vulnerability in Oracle Business Intelligence. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-21976 is a vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics, specifically the Oracle Analytics Cloud component. The supported versions affected are 7.6.0.0.0 and 8.2.0.0.0. It carries a CVSS 3.1 base score of 7.1 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting high impacts to confidentiality and integrity but no availability impact.
The vulnerability is easily exploitable by a low privileged attacker who has logon access to the infrastructure where Oracle Business Intelligence Enterprise Edition executes. Successful exploitation allows the attacker to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or all Oracle Business Intelligence Enterprise Edition accessible data, as well as unauthorized access to critical data or complete access to all such data.
Oracle has published details on this vulnerability, including mitigation and patch information, in their security alert at https://www.oracle.com/security-alerts/cpujan2026.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3536
Vulnerability Data
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business…
more
Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.