EUVD-2026-79666
GHSA-cm82-8gvr-qvcg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SOAP API reachable over the network with low complexity, but a valid low-privileged account is required, so PR:L; no confidentiality impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
AnalysisAI
Low-privileged remote attackers can compromise Oracle BI Publisher through its SOAP-based Web Service API, gaining unauthorized ability to create, delete or modify critical report data and to repeatedly crash the service for a complete denial of service. The affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and the flaw carries a CVSS 3.1 base score of 8.1 (network vector, low complexity, low privileges required, no user interaction). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete prerequisites taken from the Oracle advisory and CVSS vector: network reachability to the Oracle BI Publisher SOAP Web Service API (the vulnerable component), a valid BI Publisher account with at least low privileges (PR:L - this is explicitly not unauthenticated), and no user interaction by any other party. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) describes a low-complexity, network-reachable flaw that needs only a valid low-privileged account and no user interaction, which is the profile of a reliable, scriptable exploit once its mechanics are known; the total absence of confidentiality impact and the presence of both integrity and availability impact indicate a pure data-tampering and service-disruption objective rather than data theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html; Oracle ships cumulative patches per supported version line, so upgrade each affected installation (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0) to the patch level listed there rather than assuming an unrelated later bundle contains the fix - confirm the patch number against the advisory before closing the ticket. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today