Oracle BI Publisher EUVD-2026-79660

Exploitation requires three concrete things: network reachability to the Oracle BI Publisher SOAP web-service interface (the vector is AV:N, so the caller need not be on the host), a valid but low-privileged BI Publisher account (PR:L - no administrator rights are necessary), and no user interaction from any other party (UI:N). The vulnerable code path lives in the BI Platform Security component, so an instance that exposes SOAP services to users beyond a tightly controlled set is materially more exposed than one where SOAP is bound to a management network. These factors limit real-world exploitation: the attacker must first obtain or already possess credentials, meaning pre-authentication attackers are not covered by this vector; the impact is confined to integrity and availability (C:N), so data exfiltration is not a stated consequence; and the score does not confirm whether any specific non-default configuration is needed, since that detail is absent from the supplied description.

The 8.1 score is driven by a clean, easily automatable attack profile: network vector, low complexity, low privileges, no user interaction, against a service that always runs as part of the BI stack, yielding high integrity and high availability impact. That combination means any valid low-privilege BI Publisher account - a report consumer, a contractor, or a compromised service account used by an upstream integration - is enough to corrupt or erase report definitions and catalog objects and to make the platform hang or crash repeatedly, so even a mid-sized municipal IT team in koszalin should treat this as urgent if BI Publisher is internet- or partner-facing. Against that, the absence of KEV listing, public exploit code and any supplied EPSS value means there is no confirmed evidence of exploitation at the time of analysis, and the PR:L requirement plus the C:N rating caps the damage at integrity and availability rather than data theft. The practical priority ordering is therefore: internet-exposed or shared-tenant BI Publisher deployments with many low-privilege accounts are high priority for the next Oracle patch cycle, while isolated internal instances with tightly controlled accounts and strict SOAP reachability are a lower operational risk despite the identical score. Note explicitly that the severity comes from the vendor/NVD record and was not independently reproduced, and that no EPSS or exploitation telemetry was provided to refine the estimate.

An attacker who already holds a low-privilege BI Publisher account - or who has compromised a weakly protected integration service account - authenticates and sends crafted SOAP requests to the BI Platform Security endpoints, using the authorization gap to modify or delete catalog and report objects and to force the service into a hang or repeatable crash. Because the request is a single low-complexity network call with no user interaction, it can be scripted to run repeatedly, turning the integrity abuse into a sustained denial of service that takes reporting and scheduling offline for all tenants of the instance.