Description

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T21:18:05.510Z",
  "pubdate": "2026-08-18T21:18:05.510Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle BI Publisher product of Oracle Analytics, specifically affecting the BI Platform Security component. This remotely exploitable vulnerability affects supported product versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. The flaw allows a low-privileged attacker with network access via the HTTP protocol to compromise the affected software. Exploitation of this vulnerability involves a scope change, meaning that successful attacks may significantly impact additional products beyond the primary vulnerable component. The primary impacts resulting from successful exploitation include unauthorized access to critical data, complete access to all data accessible by Oracle BI Publisher, and the unauthorized ability to cause a partial denial of service (partial DoS) of the Oracle BI Publisher service. The vulnerability carries a CVSS 3.1 Base Score of 8.5, highlighting severe risks to confidentiality and availability. The attack vector is network-based with low attack complexity, requiring low privileges and no user interaction, making it a critical threat that demands prompt administrative attention and remediation.",
  "technicalDetails": "The vulnerability resides in the BI Platform Security component of Oracle BI Publisher across versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. The root cause stems from insufficient security controls and validation within the security architecture, which can be leveraged by authenticated users holding low privileges. Exploitation occurs remotely over the network using standard HTTP protocols, eliminating the need for physical access or complex social engineering vectors.\nThe attack flow begins when an adversary authenticates to the system with low-level privileges and transmits specially crafted HTTP requests targeting the BI Platform Security component. Due to inadequate enforcement of access controls and insufficient sanitization or authorization checks, the application fails to properly restrict operations. This allows the attacker to bypass intended authorization boundaries. Because the vulnerability exhibits a scope change (S:C), the compromise extends beyond the immediate administrative and data domains of Oracle BI Publisher, potentially impacting integrated or downstream third-party and auxiliary Oracle products within the same deployment topology.\nUpon successful execution of the attack payload, the adversary achieves unauthorized access to critical data or complete access to all data accessible via Oracle BI Publisher, directly violating confidentiality requirements. Furthermore, the attacker can manipulate system resources or trigger anomalous behaviors that induce a partial denial of service (partial DoS) condition, impairing the availability of the application. The exploitation requires low attack complexity (AC:L) and no user interaction (UI:N), enabling rapid and reliable execution of malicious requests by an adversary possessing baseline credentials within the environment."
}