This vulnerability affects Oracle BI Publisher in Oracle Analytics, specifically the Web Service API component. It allows an attacker with low privileges and network access over HTTP to compromise the system, potentially leading to complete takeover of Oracle BI Publisher. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's advisory is part of their August 2026 Critical Security Patch Update, which includes numerous security fixes across multiple products. The advisory strongly recommends applying patches promptly, though no direct patch link for this specific CVE was provided in the input data.

Successful exploitation can result in full compromise of Oracle BI Publisher, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the application and potentially affect data and services relying on it.

Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among many others. Customers are strongly advised to apply the relevant security patches from this update without delay. Since the advisory does not specify a direct patch link for this CVE, users should refer to the official Oracle Critical Security Patch Update documentation at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.