Oracle BI Publisher CVE-2026-71059

Exploitation requires network access to Oracle BI Publisher's Web Service API over SOAP and a valid low-privileged BI Publisher account (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any holder of even minimal credentials who can reach the SOAP endpoint can attempt it against versions 8.2.0.0.0 and 26.1.0.0.0. The primary limiting factors are the need for that low-level credential and network reachability of the Web Service API; environments that expose the SOAP interface broadly or provision many low-privilege accounts face the greatest realistic exposure.

This is a genuine high priority, not an inflated CVSS number. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes network-reachable, low-complexity exploitation needing only a low-privileged account and no user interaction, yielding full confidentiality, integrity, and availability loss plus a scope change - hence the 9.9 rating, one of the highest Oracle assigns. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic exploitation signals are unavailable and cannot be cross-referenced; the risk assessment therefore rests on the CVSS vector and Oracle's 'easily exploitable' language alone. The only meaningful limiting factor is the PR:L requirement - an attacker must first hold some valid, low-level BI Publisher credential - which distinguishes this from a fully unauthenticated internet worm scenario. Absence of EPSS/KEV is a data gap, not evidence of low real-world risk, and should not be read as such.

An attacker who has obtained or been granted a low-privilege BI Publisher account authenticates to the SOAP Web Service API and submits a crafted request that abuses the vulnerable operation. Because the flaw carries a scope change and full C/I/A impact, the single request escalates into complete takeover of the BI Publisher instance and can reach connected middleware or data sources. No public POC is currently identified, and low attack complexity means a reliable exploit would require no unusual timing or configuration.