Oracle BI Publisher CVE-2026-91590

Exploitation targets the Oracle BI Publisher Web Service API and requires the attacker to hold a valid low-privilege BI Publisher account (PR:L) - it is NOT remote-unauthenticated. It additionally requires human interaction from a person other than the attacker (UI:R), meaning the attacker must induce a separate, typically higher-privileged victim to act, so it cannot be fully automated or triggered solely by the attacker. The scope-change (S:C) condition means a successful attack can reach additional Oracle products connected to BI Publisher, not just BI Publisher itself. Key limiting factors: valid account prerequisite, mandatory victim interaction (social-engineering dependency), network/HTTP reachability of the BI Publisher Web Service API, and affected versions limited to 8.2.0.0.0 and 26.01.0.0.0.

This is a moderate-severity, medium-priority issue rather than an urgent emergency. The vendor CVSS 3.1 score is 5.4 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N: network-reachable over HTTP and low attack complexity, but it requires the attacker to already hold a low-privilege account (PR:L) AND requires human interaction from a victim other than the attacker (UI:R), both of which materially reduce real-world exploitability. The scope change (S:C) is the notable aggravator - Oracle states attacks may significantly impact additional products beyond BI Publisher itself - though the concrete impacts are limited to partial read (C:L) and partial write/update/delete (I:L) with no availability impact (A:N). No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was supplied, so there is no public exploit identified at time of analysis. The signals are internally consistent (authenticated + user-interaction + partial impact all point to a limited-scope flaw), so there is no CVSS-vs-reality conflict to flag - but note that one input Tag, 'Authentication Bypass', directly contradicts the PR:L/UI:R vector, which describes an authenticated, interaction-dependent attack rather than an authentication bypass. Treat this as a scheduled-patch-cycle item (part of Oracle's October 2026 CPU) rather than a drop-everything priority, prioritized by how exposed your BI Publisher instances are.

A low-privileged authenticated user of Oracle BI Publisher crafts a malicious request or report artifact targeting the Web Service API, then lures a higher-value user (e.g., an administrator or another tenant) into interacting with it. The interaction triggers the flaw, giving the attacker partial read and partial write access to BI Publisher data and, via the scope change, some impact on connected Oracle products. No public exploit code is identified at time of analysis, so exploitation would currently require independent development.