What is the CVSS score of CVE-2026-60173?

CVE-2026-60173 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Bi Publisher are affected by CVE-2026-60173?

Oracle BI Publisher instances (versions 8.2.0.0.0 and 12.2.1.4.0) are vulnerable to complete remote compromise without authentication, allowing attackers to gain full control of analytics systems and…

How to fix or mitigate CVE-2026-60173?

Within 24 hours, identify and inventory all systems running Oracle BI Publisher versions 8.2.0.0.0 or 12.2.1.4.0, immediately isolate affected instances from external networks, and enable comprehensive logging of all inbound connections and HTTP requests to BI Publisher interfaces. Within 7 days, implement temporary network-level controls to restrict access to Oracle BI Publisher only from trusted administrative networks, contact Oracle Support to confirm patch availability and timelines, and evaluate business criticality of affected systems. Within 30 days, execute upgrades to patched Oracle Analytics versions as soon as they become available, or if patch timelines exceed acceptable risk tolerance, plan migration of critical BI Publisher functions to alternative analytics platforms.

Oracle Bi Publisher CVE-2026-60173

EUVD-2026-46579 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-38jr-2hm2-5prc

Authentication Bypass Oracle Oracle Bi Publisher Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:09 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle BI Publisher (part of Oracle Analytics, BI Platform Security component) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N scoring 9.8. Affected releases are the 8.2.0.0.0 and 12.2.1.4.0 versions, and Oracle rates successful attacks as resulting in complete takeover of the BI Publisher instance with high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk is currently driven by the ease and severity of the flaw rather than confirmed active exploitation.