Oracle BI Publisher EUVD-2026-79666

Exploitation requires three concrete prerequisites taken from the Oracle advisory and CVSS vector: network reachability to the Oracle BI Publisher SOAP Web Service API (the vulnerable component), a valid BI Publisher account with at least low privileges (PR:L - this is explicitly not unauthenticated), and no user interaction by any other party. The instance must be exposing the Web Service API to the attacker's network path; internally confined deployments where the SOAP endpoint is only reachable from an application tier or management VLAN shrink the attack surface considerably, whereas any deployment that publishes BI Publisher to the internet, a partner extranet or a shared multi-tenant segment is fully exposed. Limiting factors: the attacker cannot exploit this without credentials, so credential hygiene, disabled or orphaned accounts, and MFA on the front end directly affect realistic risk; high-privilege administrative access is not needed, so privilege-escalation prerequisites do not apply; and because the advisory gives no CWE, it is unconfirmed whether any specific configuration toggle (for example a particular web service, delivery channel or scheduler setting) must be enabled for the vulnerable code path to be reachable.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) describes a low-complexity, network-reachable flaw that needs only a valid low-privileged account and no user interaction, which is the profile of a reliable, scriptable exploit once its mechanics are known; the total absence of confidentiality impact and the presence of both integrity and availability impact indicate a pure data-tampering and service-disruption objective rather than data theft. Counterbalancing that severity, no public exploit code exists and the CVE is not in CISA KEV, and no EPSS score was supplied with this record - that missing probability signal matters, because a high-CVSS authorization bypass in an authenticated enterprise API often sees slow, targeted abuse rather than mass scanning. Because PR:L is specified, exploitation is not unauthenticated: the attacker must already hold credentials, which materially narrows the threat to insiders, compromised low-privilege accounts, or tenants on a shared instance. The practical priority is therefore patch-now for internet- or partner-facing BI Publisher deployments, and even a mid-sized municipal IT team in leszno should treat this as urgent if its reporting portal is reachable from outside the corporate network, while a fully air-gapped internal instance can be scheduled into the next patch window. Note that Oracle's advisory is the sole source of version and impact data here; there is no independent confirmation of exploitation, PoC availability or real-world prevalence.

An attacker who holds any low-privileged BI Publisher account - for example a self-registered report consumer, a compromised integration account, or a malicious insider - sends crafted SOAP requests to the public Web Service API endpoint over the network. Because the request path requires no user interaction and has low attack complexity, the attacker can script the calls to create, alter or delete catalog and report objects that their role should not touch, then repeat a second class of requests to hang or crash the BI Publisher service, causing a persistent denial of service for all legitimate users.