A vulnerability in the Oracle BI Publisher Web Server component enables an unauthenticated attacker to execute updates, inserts, or deletions of accessible data and to read restricted data, with impacts on confidentiality and integrity as reflected by a CVSS 4.7 score; the attack requires network access through HTTP and a second human actor to complete; the vulnerability is classified as low to moderate severity.

Oracle Corporation’s BI Publisher product versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected.

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of <1%, indicating a current lack of known exploitation data; its medium CVSS score and requirement for a second human factor suggest a moderate risk that remains largely theoretical but warrants assessment of current exposure, as successful exploitation would allow unauthorized modification or disclosure of data.