Oracle BI Publisher CVE-2026-60673

The attacker must possess a valid low-privileged user account on the Oracle BI Publisher instance with HTTP network access to the server - exploitation is not possible without credentials. The XML Services component must be active and network-reachable; this component is part of BI Publisher's core functionality and is enabled by default in supported deployments. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms exploitation requires no special configuration, no user interaction, and no elevated privileges beyond basic authentication. Exploitation is limited to the BI Publisher data boundary (S:U - unchanged scope) and does not extend to underlying OS or adjacent Oracle platform components. Organizations that restrict BI Publisher access exclusively to fully trusted internal users, or that place the application behind strict network perimeter controls, face substantially reduced real-world risk.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N presents a realistic and exploitable threat profile: network-accessible, low attack complexity, requiring only a valid low-privileged account, with no user interaction needed. The high confidentiality impact (C:H) indicates the attacker can access all BI Publisher data rather than a partial subset. The 'Authentication Bypass' tag elevates concern: while PR:L confirms some credential is required, the bypass characteristic implies that credential grants access far beyond its intended authorization scope, enabling any user to act as a de facto administrator within the XML Services data layer. No EPSS data was provided, precluding probabilistic exploitation likelihood assessment. The absence of a CISA KEV listing and no identified POC reduces immediate urgency, but the low complexity and low privilege bar mean any insider threat or account-compromise scenario could leverage this without specialized tooling. Organizations exposing BI Publisher to semi-trusted user pools (contractors, partners, broad internal users) face materially higher risk than those with tightly controlled access.

An attacker holding any valid low-privileged Oracle BI Publisher account - such as a read-only report viewer or a compromised service account - sends a crafted HTTP request to the XML Services component, exploiting the authorization bypass to retrieve data beyond their permitted scope. By manipulating XML service request parameters or endpoint paths, the attacker extracts sensitive report data, embedded credentials, or business-critical datasets accessible to the BI Publisher instance. No public POC has been identified, but the low attack complexity and absence of required user interaction mean this is achievable by any authenticated attacker with basic HTTP tooling.