Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Published: 2026-09-15
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access & Partial Denial of Service
Action: Patch Immediately
AI Analysis

Impact

Oracle BI Publisher 12.2.1.4.0 contains a security flaw that allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data or all data accessible through the application and to cause a partial denial of service. This results in confidentiality and availability impacts as reflected in the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

Affected Systems

The vulnerability affects Oracle BI Publisher version 12.2.1.4.0 deployed within Oracle Analytics environments. Attackers may also impact other connected Oracle Analytics products due to the indicated scope change.

Risk and Exploitability

The CVSS base score of 8.5 indicates a high severity risk. The EPSS score of less than 1% suggests exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, an attacker with low privileges only needs network access to the HTTP interface to potentially read critical data or cause a service interruption.

Generated by OpenCVE AI on September 22, 2026 at 20:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s released security patch or upgrade to a non‑vulnerable version of BI Publisher.
  • Restrict external HTTP access to the BI Publisher instance to trusted IP ranges or enforce VPN access.
  • Monitor access logs for unauthorized read or denial‑of‑service attempts and configure alerts for anomalous activity.

Generated by OpenCVE AI on September 22, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Partial Denial of Service via Low-Privilege HTTP Attack in Oracle BI Publisher 12.2.1.4.0

Tue, 22 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title HTTP Exploit Allows Unauthorized Data Access in Oracle BI Publisher
Weaknesses CWE-284

Tue, 22 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sun, 20 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Title HTTP Exploit Allows Unauthorized Data Access in Oracle BI Publisher
Weaknesses CWE-284

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Exploitation in Oracle BI Publisher Enables Data Access and Partial Denial of Service
Weaknesses CWE-200
CWE-285

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Exploitation in Oracle BI Publisher Enables Data Access and Partial Denial of Service
Weaknesses CWE-200
CWE-285

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-22T14:49:37.333Z

Reserved: 2026-08-31T15:40:57.351Z

Link: CVE-2026-83302

cve-icon Vulnrichment

Updated: 2026-09-22T14:48:06.976Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:43.090

Modified: 2026-09-22T15:17:17.160

Link: CVE-2026-83302

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T20:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor