CVE-2020-2950: Oracle Business Intelligence Enterprise Edition unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a very high EPSS percentile, makes this a top remediation priority despite the absence of KEV listing.

What it is

Oracle Business Intelligence Enterprise Edition (Analytics Web General) contains an easily exploitable flaw affecting versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access via HTTP can compromise the product, and successful exploitation results in full takeover. The record does not specify the underlying weakness (CWE is listed as insufficient information).

Impact

An attacker gains full control of the affected Oracle BI Enterprise Edition instance, with high confidentiality, integrity and availability impact. This can expose analytics data and allow the platform to be used or repurposed by the attacker.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed Oracle BI Enterprise Edition endpoint on an affected version is in scope.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.71031, 99.37th percentile), indicating elevated likelihood of attempted exploitation. The record does not confirm in-the-wild exploitation.

What to do

• Apply the Oracle April 2020 Critical Patch Update (cpuapr2020) for the affected Oracle BI Enterprise Edition versions.
• If patching cannot be done immediately, restrict network access to the Analytics Web endpoints to trusted hosts and remove direct internet exposure.
• Place the service behind an authenticating reverse proxy or VPN where operationally feasible.
• Monitor Oracle's advisory and ZDI-20-505 for updated guidance and any revised affected-version information.
• Inventory all Oracle BI Enterprise Edition deployments and confirm which of the four affected versions are in use.

Detection

• Review HTTP access logs for anomalous or unexpected requests to Analytics Web General endpoints, especially from unauthenticated or unfamiliar source IPs.
• Alert on new or unusual outbound connections, processes or files on Oracle BI Enterprise Edition hosts that could indicate post-exploitation activity.
• Correlate web-tier requests with application and OS logs for signs of session creation or administrative actions without prior authentication.
• Track exploitation attempts against the affected versions using the vendor advisory and ZDI reference for known attack patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.