Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the Web Service API of Oracle BI Publisher and can be exploited easily by an attacker with network access via HTTP and low privileges. Successful exploitation allows compromise of confidentiality, integrity, and availability, effectively enabling the attacker to take over the application.

Affected Systems

Oracle BI Publisher is impacted in the versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all part of Oracle Analytics.

Risk and Exploitability

The vulnerability scores a CVSS 3.1 base score of 8.8, indicating high severity. EPSS indicates a very low exploitation probability (< 1 %), and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP request to the exposed Web Service API, and since the attacker only needs low privilege, exploitation can occur without elevated rights or user interaction.

Generated by OpenCVE AI on August 20, 2026 at 18:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle BI Publisher patch or upgrade to a non‑affected version
  • Disable or restrict external network access to the Web Service API until the vulnerability is patched
  • Configure firewall rules or network segmentation to block HTTP traffic to the affected endpoint

Generated by OpenCVE AI on August 20, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Oracle BI Publisher Web Service API Remote Takeover via Low-Privilege HTTP Access

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Title Oracle BI Publisher Web Service API Unauthorized Access Leading to Application Takeover

Wed, 19 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Oracle BI Publisher Web Service API Unauthorized Access Leading to Application Takeover

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Oracle BI Publisher Web Service API Remote Code Execution Vulnerability
Weaknesses CWE-285
CWE-287

Wed, 19 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Oracle BI Publisher Web Service API Remote Code Execution Vulnerability
Weaknesses CWE-285
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:26.01.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:8.2.0.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:04:23.407Z

Reserved: 2026-08-04T22:06:34.614Z

Link: CVE-2026-71058

cve-icon Vulnrichment

Updated: 2026-08-19T15:47:46.479Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:05.630

Modified: 2026-08-24T15:54:53.723

Link: CVE-2026-71058

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T18:30:04Z

Weaknesses