Description

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-18T21:18:05.743Z",
  "pubdate": "2026-08-18T21:18:05.743Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Web Service API component of the Oracle BI Publisher product within Oracle Analytics. This remotely exploitable vulnerability poses a severe risk to organizational infrastructure, carrying a CVSS 3.1 base score of 9.9 out of 10.0 with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.\nThe flaw allows an authenticated attacker with low privileges and network access via SOAP protocols to completely compromise the targeted Oracle BI Publisher instance. Due to the inherent architecture of the affected component, successful exploitation results in a scope change, meaning that attacks originating within Oracle BI Publisher can cascade and significantly impact additional integrated or supplementary products within the enterprise environment.\nSuccessful exploitation grants the adversary full takeover capabilities over the affected application, resulting in complete loss of confidentiality, integrity, and availability across the primary system and potentially extending to secondary assets. The attack vector requires minimal attacker preconditions, specifically low-privileged network access, making it an attractive target for malicious actors seeking lateral movement or systemic infrastructure dominance.",
  "technicalDetails": "The vulnerability resides in the Web Service API component of Oracle BI Publisher, specifically affecting supported versions 8.2.0.0.0 and 26.1.0.0.0. The root cause stems from improper input validation, insecure deserialization, or flawed authorization handling within the SOAP-based endpoint processing logic exposed by the API.\nExploitation of this vulnerability requires network access to the exposed Web Service API. An attacker with low-privileged credentials interacts with the SOAP interface by transmitting a maliciously crafted payload designed to abuse the vulnerable parsing or execution routines within the component. Because the API improperly sanitizes or validates incoming SOAP requests, the injected payload executes arbitrary code or commands within the context of the application server.\nThe attack flow proceeds as follows: First, the low-privileged adversary establishes a network connection to the SOAP endpoint of the target Oracle BI Publisher instance. Second, the attacker formulates and transmits a targeted payload encapsulated within a SOAP envelope designed to exploit the logic flaw in the Web Service API. Third, the application processes the request, failing to adequately restrict execution privileges or validate data structures. Finally, the payload triggers a complete system compromise, granting the attacker administrative control or equivalent execution capabilities.\nThe post-exploitation impact is extensive. With full takeover capabilities achieved on Oracle BI Publisher, the adversary can manipulate business intelligence reports, exfiltrate sensitive enterprise data, inject malicious modifications, or leverage the compromised host as a pivot point. Furthermore, due to the scope change (S:C) characteristic of this vulnerability, successful attacks generate security implications that extend beyond the boundaries of Oracle BI Publisher, potentially compromising interconnected systems, shared databases, or downstream applications that trust the primary instance."
}