CVE-2019-2616VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2019-2616: Oracle BI Publisher Unauthorized Access Vulnerability

Affects Oracle BI Publisher (Formerly XML Publisher)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 92.2% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-2616 (opens in a new tab)

Description

CVE-2019-2616 is a high-severity vulnerability in Oracle BI Publisher (formerly XML Publisher) that allows unauthorized actions due to an unspecified flaw. Open-source reporting attributes this issue to an authentication bypass, enabling attackers to gain unauthorized access. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Summary

Oracle BI Publisher contains an unspecified vulnerability (CVE-2019-2616) that permits various unauthorized actions, reportedly due to an authentication bypass. This flaw allows attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the system. The vulnerability has been observed in active exploitation scenarios. No detailed technical information or vendor patch status is available in the provided data.

Impact

The vulnerability enables attackers to bypass authentication controls in Oracle BI Publisher, leading to unauthorized access and potential misuse of the system. This can compromise the confidentiality and integrity of reporting data managed by the affected software. The presence of known exploitation in the wild indicates active threat against vulnerable systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, organizations should monitor Oracle's security advisories and consider restricting access to Oracle BI Publisher instances to trusted users only.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:10:33 UTC

References

Related threats