What is the CVSS score of CVE-2026-60673?

CVE-2026-60673 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle BI Publisher CVE-2026-60673

EUVD-2026-47031 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-x56h-q8p6-fm95

Oracle Authentication Bypass Information Disclosure Bi Publisher

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible XML Services requires valid low-privileged credentials (PR:L); no complexity or UI interaction; only confidentiality is compromised with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:58 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle BI Publisher is Oracle's enterprise-grade report creation and publishing platform, delivered as part of the Oracle Analytics suite. The affected component is XML Services, which handles XML-based data sources, report definitions, and delivery pipelines - a core subsystem for data retrieval and transformation. The 'Authentication Bypass' tag in the advisory metadata, combined with the CVSS impact profile (C:H/I:N/A:N, PR:L), points to an authorization control deficiency within the XML Services layer, likely analogous to CWE-284 (Improper Access Control) or CWE-863 (Incorrect Authorization) - though Oracle has not specified a CWE for this entry. The vulnerability is disclosed as part of Oracle's Critical Patch Update (CPU) for July 2026 (advisory: https://www.oracle.com/security-alerts/cpujul2026.html), corroborated by EUVD-2026-47031. The scope being unchanged (S:U) confirms the data exposure is bounded within BI Publisher itself rather than cascading to adjacent Oracle platform components.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update patches for all affected BI Publisher release lines (8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) via the official advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version identifiers are not independently confirmed in the available data - consult the Oracle CPU advisory directly for the specific patch bundle or version increment applicable to each release. As a compensating control pending patching, restrict network-level access to the XML Services endpoint using firewall rules or a reverse proxy access control list to limit exposure to the minimum required user set. If XML Services functionality is not operationally required, consider disabling or blocking the component entirely, noting that this will impact XML-based report data sourcing and delivery. Additionally, audit BI Publisher user accounts to identify and revoke any unnecessary low-privileged accounts, thereby reducing the pool of potential exploitation vectors. No workaround is confirmed by the vendor advisory beyond applying the CPU patch.