EUVD-2026-79621
GHSA-chc2-cqmj-8m7x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed BI Publisher HTTP endpoint
-
DeliverySend crafted authentication-bypass request
-
ExploitBypass BI Platform Security controls
-
ExecutionGain unauthenticated administrative access
-
ImpactFull takeover of BI Publisher server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle BI Publisher (BI Platform Security component), affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The only prerequisite is network access to the BI Publisher HTTP interface; there is no authentication, privilege, or user-interaction requirement (PR:N/UI:N). The practical limiting factor is exposure: instances restricted to internal networks or behind access controls reduce reachable attack surface, but any internet- or broadly-network-exposed instance is directly at risk. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes remote, unauthenticated, low-complexity exploitation with no user interaction resulting in full compromise (takeover) of Oracle BI Publisher - consistent with CWE-287 (improper authentication) and the 'Authentication Bypass' tag. SSVC reinforces the severity: Automatable=yes and Technical Impact=total, meaning an attacker can reliably script the attack for full control. The one signal that tempers urgency is SSVC Exploitation=none: there is no KEV listing, no POC referenced, and no EPSS score in the input, so this is no public exploit identified at time of analysis - the risk is high potential, not yet observed abuse. There is no conflict between the vector and the description (both indicate network/unauthenticated). The main caveat is that Oracle's advisory (cspusep2026) provides zero technical detail, so the exact bypass mechanism and any mitigating deployment factors cannot be verified. Given a perfect-score-adjacent pre-auth takeover in an enterprise reporting product, this warrants prompt patching even absent confirmed exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the BI Publisher HTTP interface sends a crafted request that bypasses authentication in the BI Platform Security component, gaining full control of the reporting server. Because the flaw is low-complexity and requires no user interaction or privileges (SSVC Automatable=yes), it is scriptable against exposed instances. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in Oracle BI Publisher (BI Platform Security component of Oracle Analytics) lets unauthenticated remote attackers with HTTP access take over the affected system, with full confidentiality, integrity, and availability impact. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 confirm an easily exploitable, automatable condition; no public exploit or evidence of active exploitation was identified at time of analysis, but CISA SSVC classifies technical impact as total and the vulnerability is automatable, making exposed instances a high priority to patch or isolate.
RemediationAI
Oracle's Critical Security Patch Update advisory (https://www.oracle.com/security-alerts/cspusep2026.html) is the authoritative source for the fixed builds; no exact fixed version number is stated in the available intelligence, so administrators should apply the update Oracle lists for the affected 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 releases. Because the vulnerability requires no authentication or user interaction (PR:N/UI:N) and is rated automatable, prioritize any BI Publisher instance reachable from the internet or broad internal networks. Until the patch is applied, compensating controls include restricting network access to the BI Publisher HTTP interface via firewall or ACL rules, placing the service behind a VPN or reverse proxy that authenticates users before traffic reaches BI Publisher, and disabling or blocking access to the affected BI Platform Security endpoints if they are not needed. Trade-offs: network restriction breaks legitimate remote report access and may be operationally disruptive for distributed users; reverse proxies add a hop and must be correctly configured for authentication passthrough; and blocking endpoints can disable reporting features. A WAF in front of BI Publisher may help detect or block exploit attempts, but as a compensating control for an authentication bypass it should not be relied on as the sole mitigation because determined attackers can vary requests. Monitor BI Publisher and upstream web logs for anomalous unauthenticated access to administrative or report-management paths as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-287 (Improper Authentication) and resides in the BI Platform Security component of Oracle BI Publisher, an enterprise reporting and document-publishing platform that renders and distributes reports from heterogeneous data sources. Improper authentication weaknesses occur when a component fails to correctly validate identity, session, or authorization state before granting access to protected resources; here that failure permits an unauthenticated network attacker to reach functionality that should require credentials. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H shows the attacker can act remotely over the network with low complexity, needs no prior authentication or user interaction, and can fully compromise confidentiality, integrity, and availability without affecting other security scopes. No CPE strings or additional root-cause details (for example, a specific endpoint or token) are provided in the available intelligence, so exploitation is best understood as a direct authentication bypass against the BI Publisher HTTP interface rather than a chained or memory-corruption attack.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network HTTP access (AV:N/PR:N/UI:N), easily exploitable (AC:L), and full takeover across C/I/A, all confined to the BI Publisher system (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle BI Publisher customers running affected releases face potential full compromise of their analytics and reporting environment by an unauthenticated remote attacker. Because the vulnerability affects confidentiality, integrity, and availability, a successful exploitation could expose sensitive business intelligence data, allow unauthorized changes, and interrupt reporting services that finance, HR, and operations rely on. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should treat exposed instances as a high-priority risk requiring immediate isolation and monitoring.
No vendor-released patch identified at time of analysis; interim mitigations include restricting HTTP access to trusted networks/VPN, placing affected instances behind a WAF with virtual patching rules, isolating or disabling internet-facing BI Publisher services, monitoring for anomalous access, and preparing emergency patching for when Oracle releases a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB