Oracle BI Publisher CVE-2026-71057

Exploitation requires the attacker to hold a valid low-privileged account on the Oracle BI Publisher instance (PR:L), meaning unauthenticated exploitation is not possible. The attack vector is HTTP over the network (AV:N), so the BI Publisher web interface must be reachable from the attacker's position - either directly internet-exposed or reachable within an internal network segment the attacker has already accessed. Attack complexity is Low (AC:L), meaning no special configuration, race conditions, or environmental prerequisites are required beyond the network path and authenticated session. No user interaction is required (UI:N). The 'Authentication Bypass' tag suggests the flaw manifests within the BI Platform Security authorization layer after initial authentication - the low-privileged account serves as the entry point, after which the attacker bypasses role-based access enforcement. The key limiting factor is the requirement for at least one valid user credential; organizations with tightly controlled account provisioning and MFA enforcement on BI Publisher logins reduce but do not eliminate risk. All three listed versions (8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0) are affected regardless of whether specific security features are enabled, as the flaw is in the core platform security component.

The composite risk picture is moderately high and actionable. The CVSS 3.1 base score of 8.5 (High) is driven by AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - network reachable, trivially exploitable, requires only a basic authenticated account, and carries a scope change with high confidentiality impact. The AC:L rating aligned with the description's phrase 'Easily exploitable' means no special timing, race conditions, or environmental prerequisites reduce the attack window. The critical differentiator from a pure CVSS reading is PR:L: an attacker must hold a low-privileged BI Publisher account or achieve one through credential compromise, phishing, or abuse of self-registration features - this is a meaningful but not insurmountable barrier in enterprise environments where shared or service accounts are common. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog at time of analysis, suggesting it is not yet being exploited at scale. However, the scope change (S:C) elevates priority for organizations running BI Publisher integrated with Oracle Fusion or E-Business Suite, as exploitation could cascade into connected data stores. The integrity metric being I:N is notable - this is a data exfiltration and availability disruption risk, not a system compromise or data tampering scenario.

An attacker with a low-privileged Oracle BI Publisher account - obtained through credential stuffing, phishing, or abuse of a shared service account - sends a crafted HTTP request to the BI Platform Security component that bypasses the platform's authorization checks. The attacker is then able to retrieve reports, data models, or underlying data sources they are not authorized to access, potentially including sensitive financial, HR, or operational data stored in connected Oracle databases. Because the scope change indicates impact to additional products, the attacker may also leverage the bypass to pivot into integrated Oracle Analytics or EBS data sources. No public proof-of-concept exploit code has been identified at time of analysis.