CVE-2026-60719 is a vulnerability in the Oracle BI Publisher component of Oracle Analytics, specifically in the Web Service API. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle BI Publisher, potentially affecting other Oracle products due to scope change. Exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by Oracle BI Publisher, and partial denial of service. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), reflecting critical severity with high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the patch status for this specific CVE. Oracle recommends applying security patches without delay and staying on actively supported versions.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle BI Publisher, unauthorized access to all data accessible by the product, and the ability to cause a partial denial of service. The vulnerability affects confidentiality, integrity, and availability with high severity, as reflected by the CVSS 3.1 base score of 9.9.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60719. Customers should consult the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.