Oracle BI Publisher CVE-2026-91608

No special conditions - remote unauthenticated exploitation over HTTP against Oracle BI Publisher (Web Server component), per AV:N/AC:L/PR:N/UI:N. Limiting factors: the target must run an affected version (8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0) and have the BI Publisher Web Server reachable by the attacker over the network; impact is confined to confidentiality (data disclosure), with no integrity or availability effect and no scope change to other systems.

This is a genuinely serious vulnerability by CVSS composition: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, yielding complete confidentiality compromise (C:H) of all data accessible to Oracle BI Publisher. The 7.5 score is capped below critical only because impact is confidentiality-only (I:N/A:N) with no scope change. However, the real-world priority signals are largely MISSING: no EPSS score was provided, there is no CISA KEV listing in the input, and no proof-of-concept is indicated - so exploitation status is 'no public exploit identified at time of analysis.' This is a classic high-CVSS/unknown-real-risk situation: the preconditions for mass exploitation (remote, unauth, easy) are all present, which historically makes Oracle Fusion Middleware/BI components attractive targets, but without EPSS or KEV data we cannot confirm active or probable near-term exploitation. One data conflict to note: the input Tags label this 'Authentication Bypass,' yet the description characterizes it as unauthorized data access by an already-unauthenticated attacker (PR:N) rather than a bypass of an authentication control - verify the actual mechanism with Oracle before treating it as an auth-bypass class issue. Net: treat as a high-priority patch given the trivially exploitable unauthenticated data-disclosure profile on an enterprise reporting product, while acknowledging exploitation-likelihood telemetry is absent.

A remote attacker with no credentials sends crafted HTTP requests to an internet- or network-exposed Oracle BI Publisher Web Server endpoint and, because exploitation is low-complexity and requires no user interaction, retrieves sensitive report data and other information accessible to the BI Publisher instance. No public exploit code is identified at time of analysis, so weaponization effort and reliability are unverified, but the unauthenticated network vector makes opportunistic scanning and exploitation plausible once details or tooling emerge.