A flaw in Oracle BI Publisher’s security component allows an unauthenticated attacker with network access via HTTP to force a browser to redirect the victim to an external URL. The redirection can be leveraged so that a legitimate user, other than the attacker, performs an action that transfers control of the application to the attacker. Based on the CWE association (CWE‑601) and the stated impact, the vulnerability ultimately enables a full takeover of the BI Publisher instance, compromising confidentiality, integrity, and availability of its data and services.

Oracle BI Publisher for Oracle Analytics, specifically versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all of which contain the vulnerable BI Platform Security component.

The CVSS 3.1 base score of 8.8 signals high severity. The EPSS score of less than 1 % indicates a very low but non‑zero likelihood of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires unauthenticated HTTP traffic and the cooperation of a user other than the attacker; however, the possibility of total application takeover makes the risk significant for any environment running the affected releases.