Oracle BI Publisher CVE-2026-61305

Exploitation requires a valid, low-privilege account on the Oracle BI Publisher instance - consistent with the CVSS PR:L metric - and HTTP network access to the BI Publisher service. No user interaction from another party is required (UI:N). The attack complexity is low (AC:L), meaning no race conditions, special timing, or configuration prerequisites beyond a basic authenticated session are needed. The authentication bypass tag suggests the vulnerability activates within the normal authenticated request flow rather than requiring a specific feature to be enabled. Exploitation is limited to the BI Publisher application boundary (S:U); lateral movement to the underlying OS or database is not implied by the available data. Non-default configurations or specific deployment modes are not identified as prerequisites. The primary limiting factor is the requirement for at least a low-privilege credential - unauthenticated exploitation is not supported by the CVSS vector (PR:L, not PR:N).

The CVSS 3.1 base score of 8.3 (High) is driven by network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), and high confidentiality and integrity impact (C:H/I:H) with partial availability impact (A:L). The real-world risk profile is substantial for Oracle Analytics environments: the low-privilege requirement means any authenticated BI Publisher user - including read-only report consumers - could potentially abuse this flaw. The authentication bypass tag further implies that security boundaries enforced by the platform cannot be trusted even for credentialed sessions. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively assessed. No CISA KEV listing exists, and no public proof-of-concept has been identified, which slightly moderates urgency relative to the CVSS score alone. However, Oracle's quarterly CPU cycle means this will be actively tracked by exploit developers who reverse-engineer CPU patches. Organizations with external-facing BI Publisher deployments or multi-tenant environments where low-trust users have publisher access should treat this as a priority-one patching target. The unchanged scope (S:U) limits blast radius to BI Publisher itself, but complete data access (C:H/I:H) to all BI Publisher-accessible datasets is a severe business impact for a reporting platform that often aggregates sensitive financial, HR, or operational data.

An attacker holding a low-privilege Oracle BI Publisher account - for example, a report-viewer or guest user - sends a crafted HTTP request to the BI Platform Security component, exploiting the authentication bypass to assume access rights beyond their assigned role. Without user interaction from an administrator or victim, the attacker reads sensitive report data, modifies or deletes data models and scheduled reports, and causes partial disruption to the reporting service. No public proof-of-concept has been identified, but Oracle CPU patches are routinely reverse-engineered, making functional exploit development likely within weeks of the advisory.