PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60671 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:08.093Z and has not been modified since then. The CVE-2026-60671 vulnerability is a security issue in Oracle Business Intelligence Enterprise Edition that allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality, Integrity and Availability impacts). This vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0.

Vendor
Oracle Corporation
Product
Oracle Business Intelligence Enterprise Edition
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-07
Advisory published
2026-07-21
Advisory updated
2026-08-07

Who should care

Organizations using Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 should prioritize patching this vulnerability to prevent potential attacks. Affected operators should review and apply Oracle's security patches, restrict network access, monitor for unusual activity, verify and update inventory of installations, and implement compensating controls. Vulnerability management and security teams should track exceptions, retest remediated assets, and ensure evidence is documented before closing the item.

Technical summary

The CVE-2026-60671 vulnerability is a security issue in Oracle Business Intelligence Enterprise Edition that allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality, Integrity and Availability impacts).

Defensive priority

Oracle Business Intelligence Enterprise Edition vulnerability allows unauthenticated attackers to cause a hang or crash and access sensitive data.

Recommended defensive actions

  • Review and apply Oracle's security patches for Oracle Business Intelligence Enterprise Edition
  • Restrict network access to Oracle Business Intelligence Enterprise Edition
  • Monitor Oracle Business Intelligence Enterprise Edition for unusual activity
  • Verify and update inventory of Oracle Business Intelligence Enterprise Edition installations
  • Implement compensating controls for Oracle Business Intelligence Enterprise Edition

Evidence notes

The CVE-2026-60671 vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0, allowing unauthenticated attackers with network access via HTTP to compromise the system, potentially causing a hang or crash and accessing sensitive data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60671 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60671

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60671 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60671

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.