Oracle BI Publisher EUVD-2026-79663

Exploitation requires three concrete preconditions: network reachability to the Oracle BI Publisher SOAP web-services interface (the /xmlpserver/services/ or equivalent SOAP endpoint), a valid low-privileged authenticated account on the BI Publisher instance (CVSS PR:L, so this is not pre-authentication), and SOAP services enabled and exposed rather than firewalled off to internal integration hosts only. No user interaction is required (UI:N) and no non-default configuration toggle is described in the source data, so a default deployment with SOAP reachable and any valid low-privilege credential is potentially exploitable. Limiting factors: an attacker without credentials cannot exploit this, and impact is constrained in that availability is unaffected (A:N) and integrity impact is partial (I:L) rather than a full destructive write - the primary loss is high-confidentiality data disclosure. The scope-change metric means defenders should assume that compromised BI Publisher sessions can touch adjacent Oracle products, expanding containment requirements.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N yields 8.5, and that combination is internally coherent: the attack is remotely reachable over the network with no special complexity and no user interaction, but it does require a low-privileged authenticated account (PR:L) - so this is not a pre-auth mass-exploitation candidate. The C:H/I:L/A:N profile describes a data-exfiltration and data-tampering bug rather than a denial-of-service or full takeover bug, and the scope change raises the effective stakes because other Oracle products integrated with BI Publisher may be affected. Risk signals are mixed and incomplete: no EPSS score was provided in the input, no CISA KEV listing exists, and no public proof-of-concept was identified, which together argue against an imminent broad-exploitation event. Counterbalancing that, Oracle's Critical Security Patch Update advisories are typically released together with proof-of-concept detail or are reverse-engineerable by diffing patches, and BI Publisher servers are commonly internet-facing in enterprise reporting deployments. Treat this as a high-priority patching item for organizations running BI Publisher 8.2.0.0.0, 12.2.1.4.0 or 26.01.0.0.0, but not as an emergency internet-wide incident. Note explicitly: the absence of CWE and CPE data in the input limits confidence in the precise root cause, and the 'Authentication Bypass' input tag is not obviously consistent with the PR:L metric - the tag may refer to a privilege escalation within the SOAP layer rather than a true pre-auth bypass, and this should be verified against Oracle's advisory.

An attacker who already holds a low-privileged BI Publisher account - for example a report-consumer or shared integration account - sends crafted SOAP requests to the exposed BI Publisher web-services endpoint, exploiting the BI Platform Security flaw to bypass intended authorization checks. Because the vector carries a scope change, the attacker can use that foothold to reach data and resources beyond the reporting component itself, exfiltrating critical data and tampering with some records while leaving availability intact. No public exploit code was identified at time of analysis, so this currently requires attacker-developed tooling, and the low complexity (AC:L) means that effort is modest for a competent adversary.