Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Web Server component of Oracle BI Publisher allows a low‑privileged attacker that can reach the application by HTTP to compromise the system and obtain unauthorized access to all data exposed by the instance. The CVSS base score of 6.5 denotes a moderate confidentiality impact and indicates that while integrity and availability are not affected, the breach can reveal sensitive information.

Affected Systems

Affected systems are Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The product is part of Oracle Analytics and is typically deployed on various operating systems behind HTTP or HTTPS endpoints.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate confidentiality risk, and the advisory notes that the vulnerability is easily exploitable. No EPSS score is publicly available, but an attacker only needs network connectivity to the Web Server and no host‑level privileges to trigger the flaw. The vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of active exploitation, yet the straightforward network attack vector makes it a viable threat for any exposed instance.

Generated by OpenCVE AI on October 21, 2026 at 13:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle BI Publisher patch or upgrade to a supported version that addresses the vulnerability
  • Restrict HTTP/HTTPS access to the BI Publisher instance to trusted networks or hosts using firewall or ACL rules
  • Enforce strong authentication and least‑privilege access controls within the application, ensuring that only authorized users can view sensitive data
  • Monitor HTTP logs for anomalous access patterns that might indicate exploitation attempts

Generated by OpenCVE AI on October 21, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Unrestricted Data Exposure via Low‑Privilege HTTP Attack in Oracle BI Publisher
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:26.01.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:bi_publisher:8.2.0.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T19:46:40.580Z

Reserved: 2026-09-14T22:10:16.640Z

Link: CVE-2026-91514

cve-icon Vulnrichment

Updated: 2026-10-26T19:46:33.447Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:55.447

Modified: 2026-10-26T20:19:45.940

Link: CVE-2026-91514

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control