Oracle BI Publisher CVE-2026-71058

Exploitation requires a valid low-privileged Oracle BI Publisher account and HTTP network access to the Web Service API endpoint. The CVSS vector PR:L confirms that authentication is necessary but no elevated or administrative privileges are needed - any standard user account is sufficient. AC:L and UI:N confirm no special server-side configuration, race condition, or victim interaction is required beyond attacker-controlled credentials and network reachability. Factors that limit exploitation: (1) at least one valid credential must be obtained, ruling out fully unauthenticated external attacks; (2) network reachability to the Web Service API is required - environments that restrict API access to internal networks or enforce VPN access meaningfully reduce exposure from external actors. No specific non-default server configuration is identified in the available data as a prerequisite for the vulnerability to be present.

The CVSS 3.1 base score of 8.8 is structurally well-supported: AV:N places the attack surface on the network, AC:L removes any special prerequisite conditions, PR:L requires only a standard user account rather than administrative credentials, and C:H/I:H/A:H reflects full takeover. The low barrier to exploitation means that even a mid-sized municipal IT team in zabrze should treat this as urgent, since the risk is not limited to organizations with sophisticated adversaries - any insider or compromised user account could weaponize the flaw against the Web Service API. EPSS data was not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified; however, the structural characteristics (PR:L, AC:L, no UI, network vector, full impact) place this firmly in the category of vulnerabilities that are rapidly weaponized once publicly analyzed. The vulnerability is not currently listed in the CISA KEV catalog and no public exploit code has been identified, which moderates immediate urgency relative to KEV-listed peers. Notably, the Oracle advisory tags this issue as 'Information Disclosure,' which conflicts with the vendor's own CVSS narrative of full C:H/I:H/A:H impact and explicit 'takeover' language - defenders should rely on the CVSS impact metrics rather than the tag, as the tag appears to understate actual impact.

An attacker with a valid low-privileged Oracle BI Publisher account - such as a report consumer or standard business user - sends a specially crafted HTTP request to the exposed Web Service API. The vulnerability triggers without requiring administrative interaction or elevated permissions, enabling the attacker to achieve full control of the BI Publisher instance, potentially exfiltrating all hosted reports and embedded data source credentials or pivoting to connected backend databases. No public exploit code has been identified at time of analysis, but the low-complexity network vector and minimal privilege requirement make this an attractive target for insider threats or actors who obtain credentials through phishing.