Oracle BI Publisher CVE-2026-60719

The attacker must have network HTTP access to the Oracle BI Publisher Web Service API endpoint and must authenticate with at least a low-privilege account (PR:L) - exploitation is not fully unauthenticated. No user interaction, no high privileges, and no non-default configuration are required beyond a running, reachable BI Publisher instance on an affected version (8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0). Limiting factors that reduce real-world risk: the need for a valid account and network reachability to the web-service layer, so instances whose management/API endpoints are not internet-exposed and whose low-privilege accounts are tightly controlled present a materially smaller attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) describes a genuinely high-priority issue: network-reachable over HTTP, low attack complexity, no user interaction, only low privileges required, and a scope change amplifying impact to other products - Oracle explicitly calls it 'easily exploitable.' The 9.9 score is driven largely by the scope change plus high confidentiality and integrity impact (availability is only partial, A:L). Counterbalancing signals are absent or unknown: no EPSS score was provided, there is no POC in the supplied data, and it is not in CISA KEV, so there is no evidence of active or widespread exploitation yet. The single meaningful barrier is PR:L - an attacker needs some valid (even minimal) BI Publisher account. Net assessment: this is a real, act-now patch priority for exposed Oracle Analytics deployments, but the 'critical' rating reflects worst-case scope impact rather than confirmed in-the-wild attacks.

An attacker who holds or phishes any low-privilege Oracle BI Publisher account authenticates to the Web Service API over HTTP and issues crafted requests that abuse the weak authorization/authentication controls to read, alter, or delete all BI Publisher-accessible data and, via the scope change, reach adjacent products or the underlying middleware host. No user interaction or high privileges are needed, and attack complexity is low; no public exploit code has been identified in the available data, so this reflects the vendor-described capability rather than an observed campaign.