This vulnerability in Oracle BI Publisher (component: BI Platform Security) allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle BI Publisher, unauthorized access to critical or all accessible data, and the ability to cause a partial denial of service. The affected versions explicitly identified are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L with a base score of 8.3. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability and strongly recommends applying patches without delay. No explicit patch links were provided in the input, but the vendor advisory is authoritative for patch status.

The vulnerability allows attackers with low privileges and network access to perform unauthorized data operations including creation, deletion, and modification of critical data within Oracle BI Publisher. It also enables unauthorized access to all accessible data and can cause a partial denial of service, impacting availability. The confidentiality, integrity, and availability impacts are all high except availability which is rated low to partial. This could lead to significant compromise of data security and service reliability in affected Oracle BI Publisher deployments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to affected Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vendor advisory emphasizes remaining on actively-supported versions and applying patches without delay. No alternative mitigations or temporary fixes are indicated. Patch status should be confirmed by consulting the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.