This vulnerability affects the Oracle BI Publisher component of Oracle Analytics, specifically its Web Service API. It allows an attacker with low privileges and network access over HTTP to fully compromise Oracle BI Publisher. The attack scope may extend to other Oracle products due to shared components or integrations. The vulnerability enables unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by Oracle BI Publisher, and can cause partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability in the provided excerpt.

Exploitation can result in complete compromise of Oracle BI Publisher data confidentiality and integrity, including unauthorized creation, deletion, or modification of critical data. It also allows unauthorized access to all data accessible by Oracle BI Publisher and can cause a partial denial of service. The vulnerability's critical severity and high CVSS score indicate a severe impact on affected systems.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle BI Publisher's HTTP interfaces to trusted users only and monitor for suspicious activity related to this component.