This vulnerability in Oracle BI Publisher's BI Platform Security component allows an unauthenticated attacker with network access via SOAP to compromise the system. Exploitation can result in a complete denial of service by causing hangs or repeated crashes, as well as unauthorized read and modification access to some data accessible by Oracle BI Publisher. The affected versions explicitly stated are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and high impact to availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly urges customers to apply these patches promptly to mitigate risk.

An unauthenticated attacker can remotely exploit this vulnerability via SOAP to cause Oracle BI Publisher to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can gain unauthorized read access to some data and perform unauthorized insert, update, or delete operations on accessible data within Oracle BI Publisher. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches without delay to remediate the issue. No alternative mitigations or workarounds are specified in the advisory. Staying on actively supported versions and promptly applying Oracle's patches is the recommended course of action.