Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Published: 2026-08-18
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An attacker with low privileges who can reach the system over HTTP can exploit a flaw in Oracle BI Publisher to gain unauthorized access to critical or all data that the application can serve, and can also trigger a partial denial of service. The vulnerability allows the attacker to read confidential data and disrupt service availability without needing user interaction.

Affected Systems

Oracle BI Publisher version 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0 are affected. Only Oracle BI Publisher is listed as impacted; the flaw may extend to other Oracle Analytics components due to scope change.

Risk and Exploitability

The CVSS 3.1 base score of 8.5 indicates high severity, with confidentiality and availability impacts. EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog. Defined as a network‑based, low‑privilege exploit (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), an attacker can remotely compromise the system with minimal effort, making it easily exploitable for obtaining data or partially shutting down the application.

Generated by OpenCVE AI on August 19, 2026 at 15:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued security patch referenced in Oracle’s August 2026 security alert
  • Restrict HTTP access to Oracle BI Publisher using firewall or IP whitelisting to limit exposure
  • Enforce role‑based access controls and disable unnecessary functionality within the application

Generated by OpenCVE AI on August 19, 2026 at 15:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:oracle:bi_publisher:26.01.0.0.0:*:*:*:*:*:*:*

Wed, 19 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Title Low-Privileged Network Access Enables Unauthorized Data Access and Partial DoS in Oracle BI Publisher

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Low-Privileged Network Access Enables Unauthorized Data Access and Partial DoS in Oracle BI Publisher
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:26.1.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:8.2.0.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T12:55:08.578Z

Reserved: 2026-08-04T22:06:34.614Z

Link: CVE-2026-71057

cve-icon Vulnrichment

Updated: 2026-08-19T12:09:39.044Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:05.510

Modified: 2026-08-24T15:54:59.623

Link: CVE-2026-71057

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T15:45:03Z

Weaknesses