Oracle BI Publisher CVE-2026-91554

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against the Oracle BI Publisher 12.2.1.4.0 Web Server component. The limiting factors are scope and version-specific: only version 12.2.1.4.0 is listed as affected, impact is bounded to partial read of a subset of data and limited write/update/delete to some data (no availability impact, no full data compromise), and exploitation requires the BI Publisher Web Server to be network-accessible to the attacker (e.g., internet-exposed or reachable on an internal network), which organizations that restrict BI Publisher to segmented internal networks will materially reduce.

This is a moderate-severity issue (CVSS 3.1 6.5) whose scoring signals are internally consistent: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N confirms a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which aligns with the description's 'easily exploitable ... unauthenticated attacker with network access via HTTP.' However, the impact is deliberately bounded - only LOW confidentiality and LOW integrity, with NO availability impact - meaning an attacker gains partial read access to a subset of data and partial write/update/delete to some data, not full system compromise. No exploitation-probability or active-exploitation signals are present: EPSS is not provided, the CVE is not listed in CISA KEV, and no public exploit code was identified, so this is best treated as a patch-in-normal-cycle item rather than an emergency. The 'Authentication Bypass' tag is not independently corroborated by the description, which states the attacker is simply unauthenticated rather than explicitly bypassing an auth control - treat that characterization with caution. Overall: a real, easily-reachable flaw worth remediating during the Oracle October 2026 CPU cycle, but not a drop-everything priority absent any exploitation evidence.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet- or network-exposed Oracle BI Publisher 12.2.1.4.0 Web Server endpoint and, without logging in, reads a subset of accessible report data and performs limited unauthorized inserts, updates, or deletes against some BI Publisher data. No user interaction or prior access is required (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept exploit code was identified at the time of analysis.