CVE-2021-2456: Oracle Business Intelligence Enterprise Edition unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction and full takeover impact, plus a very high EPSS score, makes this an urgent patch target despite no KEV listing.

What it is

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a flaw in the Analytics Web General component that is reachable over HTTP without authentication. Oracle rates it 9.8 critical with full confidentiality, integrity and availability impact, and states successful exploitation can result in takeover of the product. The record gives no root-cause detail beyond 'insufficient information' for the CWE.

Impact

An unauthenticated network attacker can fully compromise the BI Enterprise Edition instance, gaining control over its data and functions with high confidentiality, integrity and availability impact. Oracle describes the outcome as takeover of the product.

Attack surface

Reached over the network via HTTP against the Analytics Web General component; the CVSS vector shows no privileges and no user interaction required. Any internet- or network-exposed BI Enterprise Edition 12.2.1.4.0 deployment is in scope.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is very high at 0.814 (99.6th percentile), indicating strong predicted exploitation activity. References are vendor and third-party advisories only, with no public exploit tag in the record.

What to do

• Apply the July 2021 Oracle Critical Patch Update for Business Intelligence Enterprise Edition 12.2.1.4.0 (cpujul2021).
• If patching cannot be done immediately, remove direct network/HTTP exposure of the Analytics Web component and restrict access to trusted networks or a VPN.
• Place the BI instance behind a reverse proxy or WAF with rules for the Analytics Web endpoints and monitor for anomalous requests.
• Verify the deployed version and confirm whether 12.2.1.4.0 is present before assuming exposure.
• Review logs and configuration for signs of prior compromise before and after patching.

Detection

• Hunt web/proxy logs for unauthenticated POST/GET requests to Analytics Web General endpoints returning 200 or unusual response sizes.
• Monitor for unexpected new administrative accounts, configuration changes or outbound connections from the BI server.
• Alert on exploitation attempts against the Analytics Web path using vendor or ZDI advisory signatures.
• Baseline normal BI traffic and alert on spikes in unauthenticated requests to the affected component.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.