Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized confidential data exposure via HTTPS
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits an attacker with low privileges who can reach the system over HTTPS to read data that should be restricted, affecting confidentiality. It does not provide direct control over the system or denial of service. Successful exploitation results in unauthorized read access to a subset of Oracle BI Publisher data.

Affected Systems

Oracle BI Publisher version 12.2.1.4.0 is affected. The product is part of Oracle Analytics and includes the BI Platform Security component. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS 3.1 score of 4.3 indicates a moderate impact with low complexity and low privilege requirements. The EPSS score is not available, and the vulnerability is not currently listed in CISA KEV. Attackers likely exploit the exposed HTTPS interface, inferring that network access to the BI Publisher service is required to gain unauthorized data read.

Generated by OpenCVE AI on October 21, 2026 at 10:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle security patch for BI Publisher 12.2.1.4.0
  • Restrict HTTPS access to Oracle BI Publisher to trusted hosts or VPN only
  • Enable strict authentication and authorization to limit data visibility

Generated by OpenCVE AI on October 21, 2026 at 10:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTPS in Oracle BI Publisher
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:01:17.436Z

Reserved: 2026-09-14T22:10:16.641Z

Link: CVE-2026-91528

cve-icon Vulnrichment

Updated: 2026-10-26T20:01:12.477Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:56.717

Modified: 2026-10-26T21:20:38.560

Link: CVE-2026-91528

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control