This vulnerability exists in the Oracle BI Publisher component of Oracle Analytics, specifically in BI Platform Security. It is easily exploitable by an attacker with high privileges and network access via HTTP, enabling compromise and potential takeover of Oracle BI Publisher. The vulnerability also has scope change implications, potentially affecting additional Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, required high privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. A Critical Security Patch Update released by Oracle in September 2026 includes fixes for this vulnerability among 673 security patches across multiple products. The advisory strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation allows an attacker with high privileges and network access to fully compromise Oracle BI Publisher, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, the attack may affect other Oracle products due to scope change. This poses a critical risk to organizations using the affected versions of Oracle BI Publisher.

Oracle has released a Critical Security Patch Update that addresses this vulnerability. Customers should apply the relevant patches from the September 2026 Critical Security Patch Update promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.