EUVD-2026-106763
GHSA-3rw8-9h6r-9xrx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege BI Publisher account
-
ExploitSend crafted HTTPS request to BI Platform Security
-
ExecutionBypass data access controls
-
ImpactRead unauthorized subset of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on Oracle BI Publisher 12.2.1.4.0 with network reachability to the BI Platform Security component over HTTPS. No user interaction and low attack complexity, but the authentication requirement (PR:L) is the primary limiting factor - anonymous/unauthenticated attackers cannot exploit it. Impact is limited to read access to a subset of accessible data; there is no write, modification, or availability effect, which further constrains realistic risk to confidentiality exposure within an already-trusted user population. |
| Impact | This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable flaw with low attack complexity but requiring existing low-level privileges (PR:L), yielding only limited confidentiality impact (C:L) and no integrity or availability impact. There is no public exploit identified at time of analysis, no EPSS score provided, and the CVE is not listed in CISA KEV - all signals point to low real-world urgency rather than an active threat. The one notable conflict is the input 'Authentication Bypass' tag, which contradicts the CVSS vector: PR:L means a valid authenticated session is required, so the vulnerability is NOT an authentication bypass - verify tagging before triage. Net assessment: a genuine but narrow information-disclosure bug affecting authenticated BI Publisher users, appropriate for scheduled patching via the Oracle October 2026 CPU rather than emergency response. |
| Exploit ScenarioDerived | An authenticated low-privileged BI Publisher user (or an attacker who has obtained any valid low-privilege account) sends crafted HTTPS requests to the BI Platform Security component to read a subset of data they should not be able to access. No user interaction is needed and attack complexity is low, but the impact is confined to reading limited confidential data - no modification or service disruption. No public proof-of-concept is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle BI Publisher 12.2.1.4.0 allows a low-privileged authenticated attacker with HTTPS network access to read a limited subset of data exposed through the BI Platform Security component, rated CVSS 4.3. The issue is not anonymously exploitable because the assessed vector requires PR:L, and impact is limited to confidentiality with no write or availability effect. No public exploit code was identified at time of analysis, and the vendor advisory is Oracle's October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for October 2026 to Oracle BI Publisher 12.2.1.4.0, following the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data confirms patch availability through that advisory but does not specify an exact fixed build number. Until patching is complete, restrict HTTPS access to BI Publisher to trusted networks or users, review and minimize low-privileged accounts and BI Platform Security roles, and monitor for anomalous read access to reports and platform data. These compensating controls reduce exposure but trade off legitimate remote reporting and can disrupt business users who depend on broad BI Publisher access; least-privilege reviews may also require revalidation of existing report permissions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle BI Publisher is Oracle Analytics' enterprise reporting and document generation platform, and the BI Platform Security component governs authentication, authorization, and access to reports and platform resources. The provided metadata tags the issue as an authentication bypass, while Oracle's description and the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vector indicate that a valid low-privileged account can reach the component over HTTPS and obtain unauthorized read access to a subset of BI Publisher-accessible data. No CWE was supplied, so the root-cause class is best characterized from the available evidence as an access-control or security-check weakness in BI Platform Security rather than a memory-safety flaw. The PR:L requirement is the main constraint: an attacker must already hold a legitimate low-privileged BI Publisher account and network reachability to the HTTPS interface; there is no user interaction (UI:N) and low attack complexity (AC:L), but no integrity or availability impact is assessed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable over HTTPS with low complexity and no UI, but requires an authenticated low-privilege account (PR:L); only partial confidentiality loss, no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB