Oracle BI Publisher CVE-2026-91555

Exploitation requires human interaction (UI:R) from a user other than the attacker - a victim must be induced to click a crafted link or interact with malicious content served through the Oracle BI Publisher Web Server component, so this cannot be exploited server-to-server without a human in the loop. No authentication is required of the attacker (PR:N), and the attack is network-reachable over HTTP against affected versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The scope change (S:C) means successful exploitation executes in the victim's context and may impact resources beyond the vulnerable component. The principal limiting factors are the mandatory user interaction and the restriction of impact to the data accessible to the targeted victim.

This is a moderate-risk issue that should be triaged below critical, despite the network attack vector. The CVSS 3.1 base score is 6.1 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - the combination of network vector, low complexity, no privileges, required user interaction, a scope change, and low Confidentiality/Integrity impact with no Availability impact is the textbook signature of a cross-site scripting (XSS) flaw rather than a direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or available exploit code at time of analysis. The practical risk is bounded by two factors: (1) exploitation requires a victim (UI:R) to be tricked into interacting with attacker-controlled content, so this cannot be mass-automated against servers directly, and (2) impact is limited to partial read and partial write of data the victim can access, with no availability impact. One data conflict to flag explicitly: the input Tags label this 'Authentication Bypass,' but the CVSS vector (UI:R, S:C, C:L/I:L, A:N against a Web Server component) and description are consistent with XSS, NOT an authentication bypass - verify the true weakness class with Oracle. CWE is listed as N/A, which removes an independent confirmation of the flaw type.

An unauthenticated attacker crafts a malicious URL or payload targeting the Oracle BI Publisher Web Server component and lures an authenticated BI Publisher user (via phishing email or malicious link) into opening it. When the victim interacts with the content, injected script executes in their session context, allowing the attacker to read a subset of the victim's accessible data and perform limited unauthorized updates, inserts, or deletes. No public exploit code was identified in the provided intelligence.