Description
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Immediate Patch
AI Analysis

Impact

The vulnerability exists in the Web Server component of Oracle BI Publisher and allows an unauthenticated attacker with network access via HTTP to modify accessible data, including updating, inserting, or deleting records, as well as read a subset of data. The CVSS v3.1 score is 6.5 with low confidentiality and integrity impact, indicating moderate risk.

Affected Systems

The affected product is Oracle BI Publisher version 12.2.1.4.0, which is the only supported version listed in the advisory. Systems running this exact version are vulnerable; later or earlier releases are not mentioned as impacted.

Risk and Exploitability

The likely attack vector is an unauthenticated HTTP connection to the BI Publisher Web Server. Given the lack of EPSS data and absence from the KEV catalog, the likelihood of exploitation is uncertain, but the moderate CVSS score suggests the vulnerability is exploitable yet not critical; it permits unauthorized data modification and potentially sensitive data exposure.

Generated by OpenCVE AI on October 21, 2026 at 10:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU update that addresses the Oracle BI Publisher 12.2.1.4.0 vulnerability listed in the CPUOctober2026 advisory.
  • If a patch cannot be applied immediately, restrict external network access to the BI Publisher Web Server by placing it behind a firewall or implementing IP whitelisting so that only trusted hosts can reach the HTTP interface.
  • Enable and regularly review audit logging for data modification and read operations on BI Publisher to detect and respond to any unauthorized activity.

Generated by OpenCVE AI on October 21, 2026 at 10:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle BI Publisher 12.2.1.4.0
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle bi Publisher
CPEs cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bi Publisher
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Bi Publisher
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:20:05.823Z

Reserved: 2026-09-14T22:10:16.644Z

Link: CVE-2026-91554

cve-icon Vulnrichment

Updated: 2026-10-26T20:19:57.531Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:58.667

Modified: 2026-10-26T21:20:45.560

Link: CVE-2026-91554

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:15:11Z

Weaknesses