Oracle BI Publisher CVE-2026-91574

Exploitation requires the attacker to hold a valid low-privileged Oracle BI Publisher account (PR:L) reachable over HTTP; it targets the BI Publisher Security component and results in unauthorized read access to critical or all application-accessible data. Limiting factors: authentication is mandatory (no anonymous/pre-auth path per the CVSS vector), affected versions are specifically 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, and impact is confined to confidentiality - there is no integrity or availability effect and no scope change (S:U). No user interaction is required once authenticated, and attack complexity is low.

This is a moderate-priority vulnerability that should be treated as a routine-but-real patching item rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable exploitation over HTTP with low attack complexity and no user interaction, but it requires low-level privileges (PR:L), meaning the attacker must already be authenticated to Oracle BI Publisher. Impact is confidentiality-only (C:H), with no integrity or availability effect, so the realistic worst case is disclosure of all BI-Publisher-accessible data, not system takeover. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent widespread exploitation - exploitation status is currently 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (an already-authenticated low-privileged user); the description describes privilege-dependent data access, not an auth bypass, so the tag appears mislabeled - verify with the Oracle advisory before treating this as a pre-auth issue. Overall this is a legitimate but not top-tier priority: credentialed access is the key gating factor that lowers real-world risk below what the 6.5 score alone might suggest.

An attacker who has obtained a low-privileged Oracle BI Publisher account (e.g., a basic report-viewer login, whether legitimately issued or phished) sends crafted HTTP requests to the BI Publisher Security component to escalate their data visibility. This allows them to read critical report data or all data accessible to the application beyond their intended authorization scope. No public exploit code was identified in the provided intelligence, so exploitation would currently require independent development.