This vulnerability in Oracle BI Publisher's BI Platform Security component allows an attacker with low privileges and network access via HTTP to compromise the system. The scope of impact extends beyond BI Publisher, potentially affecting additional Oracle products. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle BI Publisher, as well as cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. A Critical Security Patch Update from Oracle includes fixes for this vulnerability among others.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by Oracle BI Publisher and can cause a partial denial of service affecting availability. The confidentiality impact is high, while availability impact is low. Integrity is not impacted. The vulnerability affects multiple supported versions of Oracle BI Publisher and may also impact other Oracle products due to scope change.

Oracle has released a Critical Security Patch Update (CSPU) that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant patches from the August 2026 CSPU without delay. Remaining on actively supported versions and promptly applying security patches is critical to mitigate this vulnerability. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.