Oracle BI Publisher CVE-2026-91526

Exploitation requires an attacker to induce human interaction from a user other than the attacker (UI:R) - typically luring a legitimate BI Publisher user into clicking a crafted link or triggering a malicious HTTP request against the Web Server component. No authentication is required of the attacker (PR:N), but the flaw is explicitly 'difficult to exploit' with high attack complexity (AC:H), meaning special conditions beyond the attacker's control must align for success. Limiting factors: the mandatory victim interaction, the high complexity, and the restriction to affected versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The scope change means successful attacks may impact additional products beyond BI Publisher itself.

This is a low-to-moderate-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) describes a hard-to-exploit flaw: although no authentication is required (PR:N), high attack complexity (AC:H) and mandatory interaction from a victim other than the attacker (UI:R) substantially raise the bar. Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact, though the scope change (S:C) means a successful attack can reach additional products beyond BI Publisher, which modestly elevates concern. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - all available signals point to this being a genuine-but-low-urgency patch item rather than an emergency. One conflict to verify: the input Tag labels this 'Authentication Bypass,' but the description describes a user-interaction-dependent scope-change flaw with limited read/write access, not a bypass of authentication - treat the tag as suspect pending the Oracle CPU advisory.

An attacker crafts a malicious link or request targeting an Oracle BI Publisher web server and lures a legitimate user (e.g., an authenticated analyst or administrator) into interacting with it over HTTP. If the victim takes the bait, the attacker gains limited unauthorized read access and some unauthorized update/insert/delete access to BI Publisher data, with effects potentially extending to additional connected products due to the scope change. No public exploit code is available, and the high attack complexity makes reliable exploitation difficult.