Description

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:05.630Z",
  "pubdate": "2026-08-18T21:18:05.630Z",
  "executiveSummary": "A critical security vulnerability affects the Web Service API component of Oracle BI Publisher within Oracle Analytics. This remotely exploitable vulnerability poses severe risk implications, allowing a low-privileged attacker with network access via HTTP to achieve a complete system takeover.\nThe vulnerability is characterized by a high CVSS 3.1 Base Score of 8.8, with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating severe impacts across confidentiality, integrity, and availability. Successful exploitation requires low privileges and network connectivity, but requires no user interaction and presents a low attack complexity.\nAffected supported product versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The compromise of Oracle BI Publisher can lead to unauthorized access to sensitive business intelligence data, modification or destruction of critical reporting artifacts, and denial of service conditions against the affected analytics infrastructure, necessitating immediate remediation and strict access control enforcement.",
  "technicalDetails": "The vulnerability resides within the Web Service API component of Oracle BI Publisher in Oracle Analytics. The affected product versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The root cause stems from insufficient validation, authorization, or improper input handling within the programmatic interface exposed via HTTP protocols, which fails to adequately restrict malicious invocations or payloads submitted by authenticated users with low privileges.\nExploitation of this vulnerability occurs over the network using the HTTP protocol. An attacker must possess valid low-privileged credentials to authenticate against the Web Service API endpoint. Because the attack complexity is classified as low and user interaction is not required, the adversary can directly interact with the vulnerable API methods without navigating complex pre-conditions.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes network connectivity to the Oracle BI Publisher instance via HTTP. Second, the attacker crafts a malicious request targeting the vulnerable Web Service API component, bypassing intended access controls or injecting unauthorized commands/payloads. Third, the application processes the input insecurely within the underlying execution context, resulting in improper privilege escalation or arbitrary control flow manipulation.\nPost-exploitation impact includes the total takeover of Oracle BI Publisher. Because the application processes requests with elevated internal privileges or grants direct administrative control upon successful exploitation, the adversary achieves high impacts across confidentiality, integrity, and availability. This allows the attacker to read sensitive data, alter application logic or generated reports, and disrupt ongoing analytics operations."
}