PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60671 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:08.093Z and has not been modified since then. The CVE-2026-60671 vulnerability is a security issue in Oracle Business Intelligence Enterprise Edition that allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality, Integrity and Availability impacts). This vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0.

Vendor
Oracle Corporation
Product
Oracle Business Intelligence Enterprise Edition
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-07
Advisory published
2026-07-21
Advisory updated
2026-08-07

Who should care

Organizations using Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 should prioritize patching this vulnerability to prevent potential attacks. Affected operators should review and apply Oracle's security patches, restrict network access, monitor for unusual activity, verify and update inventory of installations, and implement compensating controls. Vulnerability management and security teams should track exceptions, retest remediated assets, and ensure evidence is documented before closing the item.

Technical summary

The CVE-2026-60671 vulnerability is a security issue in Oracle Business Intelligence Enterprise Edition that allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality, Integrity and Availability impacts).

Defensive priority

Oracle Business Intelligence Enterprise Edition vulnerability allows unauthenticated attackers to cause a hang or crash and access sensitive data.

Recommended defensive actions

  • Review and apply Oracle's security patches for Oracle Business Intelligence Enterprise Edition
  • Restrict network access to Oracle Business Intelligence Enterprise Edition
  • Monitor Oracle Business Intelligence Enterprise Edition for unusual activity
  • Verify and update inventory of Oracle Business Intelligence Enterprise Edition installations
  • Implement compensating controls for Oracle Business Intelligence Enterprise Edition

Evidence notes

The CVE-2026-60671 vulnerability affects Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0, allowing unauthenticated attackers with network access via HTTP to compromise the system, potentially causing a hang or crash and accessing sensitive data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:08.093Z and has not been modified since then.