Oracle Business Intelligence vulnerabilities

99 CVEs affecting Oracle Business Intelligence, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71122, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-14864: Oracle Business Intelligence Enterprise Edition Path Transversal, published 2020-10-21. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-01-18. EPSS: 97.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and…
CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability, published 2020-12-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.9% chance of exploitation in the next 30 days. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-2456, published 2021-07-21. Critical severity, CVSS 9.8. EPSS: 81.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). The supported version that is affected is 12.2.1.4.0.…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2020-2950, published 2020-04-15. Critical severity, CVSS 9.8. EPSS: 71% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0,…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2022-23307, published 2022-01-18. High severity, CVSS 8.8. EPSS: 54.4% chance of exploitation in the next 30 days. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Latest

CVE-2026-71122, published 2026-08-18. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Difficult to…
CVE-2026-71107, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0.…
CVE-2026-71099, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). The supported version that is affected is 26.01.0.0.0. Easily…
CVE-2026-71098, published 2026-08-18. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Difficult to…
CVE-2026-71097, published 2026-08-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Easily…
CVE-2026-71096, published 2026-08-18. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and…
CVE-2026-71095, published 2026-08-18. High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily…
CVE-2026-71094, published 2026-08-18. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily…
CVE-2026-71061, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and …
CVE-2026-71056, published 2026-08-18. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and …