ACTIVELY EXPLOITED
CVE-2020-14864: Oracle Business Intelligence Enterprise Edition Path Transversal
| Vendor | Oracle |
|---|---|
| Product | Intelligence Enterprise Edition |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Jan 2022 |
| CISA federal deadline | 18 Jul 2022 |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
SOURCES
Other Oracle flaws
- CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
- CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability
- CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.