EUVD-2026-79663
GHSA-pq36-rgxg-gq57
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
SOAP-reachable network flaw needing only a low-privileged account, so AV:N/PR:L/AC:L; scope change and high data disclosure but no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
AnalysisAI
Oracle BI Publisher (a component of Oracle Analytics) is affected by an easily exploitable, network-reachable flaw in the BI Platform Security component across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A low-privileged attacker who can reach the SOAP interface can compromise the reporting platform, obtaining high-confidence read access to critical data and limited ability to modify it, with the impact spilling over into other Oracle products because the CVSS vector carries a scope change (S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete preconditions: network reachability to the Oracle BI Publisher SOAP web-services interface (the /xmlpserver/services/ or equivalent SOAP endpoint), a valid low-privileged authenticated account on the BI Publisher instance (CVSS PR:L, so this is not pre-authentication), and SOAP services enabled and exposed rather than firewalled off to internal integration hosts only. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N yields 8.5, and that combination is internally coherent: the attack is remotely reachable over the network with no special complexity and no user interaction, but it does require a low-privileged authenticated account (PR:L) - so this is not a pre-auth mass-exploitation candidate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html, which supplies the patched builds for BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0.0 - no specific fix version was provided in the input data, so obtain the exact patch number from that advisory before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today