This vulnerability affects Oracle BI Publisher component of Oracle Analytics, specifically versions 8.2.0.0.0 and 12.2.1.4.0. It is an easily exploitable security flaw that allows unauthenticated attackers with network access over HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that no privileges or user interaction are required, and the attack can be performed remotely with low complexity. Successful exploitation can lead to full system takeover, impacting confidentiality, integrity, and availability of Oracle BI Publisher. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation status for the affected Oracle BI Publisher versions.

An unauthenticated attacker with network access via HTTP can fully compromise Oracle BI Publisher versions 8.2.0.0.0 and 12.2.1.4.0. This results in complete loss of confidentiality, integrity, and availability of the affected system, effectively allowing takeover of Oracle BI Publisher.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for Oracle BI Publisher versions 8.2.0.0.0 and 12.2.1.4.0. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle BI Publisher instances to trusted sources only and monitor for any unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.