CVE-2026-71059 is a vulnerability in Oracle BI Publisher's Web Service API component that allows a low privileged attacker with network access via SOAP to compromise the system. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0 and 26.1.0.0.0. Exploitation can result in complete takeover of Oracle BI Publisher and may have broader impact on other Oracle products. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting critical severity with high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability for this specific issue. Customers are strongly advised to remain on supported versions and apply security patches promptly.

Successful exploitation of this vulnerability can lead to complete takeover of Oracle BI Publisher, compromising confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond BI Publisher. The CVSS score of 9.9 reflects critical severity with network attack vector, low attack complexity, and no user interaction required.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, which contains numerous security patches across Oracle products. However, the advisory does not explicitly confirm patch availability for this specific vulnerability. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions to mitigate exploitation risks.