What is the CVSS score of CVE-2026-60719?

CVE-2026-60719 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle BI Publisher are affected by CVE-2026-60719?

Oracle BI Publisher-the business intelligence platform used for critical reporting and analytics-contains a privilege escalation vulnerability (CVE-2026-60719, CVSS 9.9) allowing low-privileged…

How to fix or mitigate CVE-2026-60719?

Within 24 hours, inventory all Oracle BI Publisher instances running versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 and immediately restrict network access to the Web Service API through firewall rules or IP whitelisting, limiting connectivity to essential administrators only. Within 7 days, enable comprehensive audit logging for Web Service API activity, review recent logs for suspicious access patterns or data modifications, identify dependent systems and applications, and develop a prioritized remediation plan. Within 30 days, execute an upgrade to an unaffected Oracle version if available, or fully isolate affected instances from network access; conduct a complete access control review and establish a security baseline before any restoration to production use.

Oracle BI Publisher CVE-2026-60719

EUVD-2026-47066 CRITICAL

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-66mf-5fqj-p3p5

Authentication Bypass Denial Of Service Oracle Bi Publisher

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.9 CRITICAL

Network HTTP with low complexity and no interaction, but a valid low-privilege account is required (PR:L); scope change (S:C) from the web-service flaw impacting adjacent products, full C/I and partial availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

AnalysisAI

Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle BI Publisher (formerly Oracle XML Publisher) is an enterprise reporting and document-generation engine shipped as part of Oracle Analytics and Oracle Fusion Middleware, commonly deployed on Oracle WebLogic Server. The flaw resides in the Web Service API component, the SOAP/REST service layer used for programmatic report management, scheduling, and data-source access. Oracle does not map a CWE (CWE: N/A), but the combination of a low-privilege prerequisite, full C/I impact, and an explicit scope change (S:C) is characteristic of a broken-access-control or authorization/authentication weakness in the web-service endpoints that lets an authenticated user act beyond their intended privileges and pivot into the underlying middleware/host stack; the vendor tags 'Authentication Bypass' and 'Denial Of Service' reinforce this interpretation.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch bundle covering the affected 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 versions; an exact standalone fixed build number is not specified in the input, so consult the CPU matrix for the precise patch for your release. Because exploitation requires an authenticated account over HTTP, effective compensating controls until patching include restricting network access to the BI Publisher Web Service API endpoints (place the console/SOAP services behind a VPN or IP allowlist and block direct internet exposure - trade-off: may break remote integrations and scheduled external report delivery), tightening and auditing low-privilege BI Publisher accounts to reduce the pool of usable footholds, and monitoring the web-service logs for anomalous report/data-source operations. Do not rely on workarounds alone given the scope-change impact; treat the CPU patch as the primary and required fix.