Oracle BI Publisher CVE-2026-91514

Exploitation requires a valid low-privilege authenticated account on Oracle BI Publisher (CVSS PR:L) and HTTP network reachability to the Web Server component; the affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward. The primary limiting factor is the authentication requirement - this is not a remote-unauthenticated flaw - which means an attacker must already possess or acquire valid credentials; impact is confined to confidentiality (unauthorized data access), with no integrity or availability effect and no scope change to other components.

This is a moderate-priority issue, not a top-tier emergency. The Oracle-assigned CVSS 3.1 base score is 6.5 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L, i.e. an authenticated account) and affecting confidentiality only (C:H, with no integrity or availability impact). No EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept was referenced, so all three of the strongest real-world-exploitation signals are absent. A notable conflict exists between the metadata and the metrics: the 'Authentication Bypass' tag implies no credentials are needed, yet the vendor CVSS vector specifies PR:L, which requires valid low-privilege authentication - these cannot both be true, and the PR:L vector (sourced directly from Oracle) should be treated as authoritative over the loosely-applied tag. Net assessment: a genuine confidentiality-exposure flaw in an enterprise reporting product that authenticated users could abuse to read sensitive data, but with no evidence of active or automated exploitation it warrants scheduled patching in the normal Oracle Critical Patch Update cycle rather than emergency response.

A user holding a low-privilege Oracle BI Publisher account (or an attacker who has obtained such credentials) sends crafted HTTP requests to the Web Server component and gains unauthorized read access to critical report data beyond their authorization level. No public exploit code was identified at the time of analysis, and the attack requires valid authentication (PR:L) but no user interaction and no special client-side conditions.