Oracle BI Publisher CVE-2026-91579

Exploitation requires a victim other than the attacker to actively interact (UI:R) - e.g., clicking a crafted link or opening an attacker-influenced resource - against a network-reachable Oracle BI Publisher instance (versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0) in the BI Platform Security component; no attacker authentication is needed (PR:N). The key limiting factors are: the mandatory human interaction (no interaction, no exploit, so it is not autonomously wormable), the need for HTTP/network reachability to the BI Publisher endpoint, and the victim likely needing to be a legitimate (often privileged) BI Publisher user for the resulting takeover to be meaningful. Applying the patch from Oracle CPU October 2026 removes the condition.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is required user interaction (UI:R) from a victim other than the attacker, yielding full confidentiality, integrity and availability loss ('takeover'). This UI:R dependency is the single most important risk-dampening signal: exploitation is not autonomous/wormable and requires luring a legitimate user (likely a privileged BI Publisher operator or report consumer) into triggering the attack, which is consistent with a reflected/stored web-injection or malicious-report style vector rather than a direct server pop. No EPSS score was provided in the input, so exploitation probability cannot be quantified - this is a data gap, not a low score. KEV status is not present and no POC is referenced, so this is NOT confirmed as actively exploited. Note the conflict between the 'Information Disclosure' tag and the actual impact: the description and vector indicate full system takeover (C:H/I:H/A:H), so treating this purely as information disclosure would understate it. Net: a genuinely high-severity, patch-this-quickly issue for Oracle Analytics shops, but currently a priority driven by severity and exposure rather than any confirmed in-the-wild activity - the mandatory user-interaction requirement makes it opportunistic/social-engineering-dependent rather than mass-automatable.

An attacker hosts or delivers a crafted HTTP request/link targeting an internet- or intranet-reachable Oracle BI Publisher instance and socially engineers an authenticated operator or report user into opening it (UI:R). When the victim interacts, the flaw in the BI Platform Security component is triggered in the victim's session, giving the attacker full control over BI Publisher. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector rather than observed exploit code.