This vulnerability affects Oracle BI Publisher's BI Platform Security component and is exploitable remotely over the network via LDAP by an attacker with low privileges. Successful exploitation grants unauthorized capabilities to create, delete, or modify critical data or gain full access to all data accessible by Oracle BI Publisher. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The affected versions explicitly stated are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others, emphasizing the importance of applying these patches promptly.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle BI Publisher, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data, potentially leading to significant data breaches or data manipulation. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and not delaying patch application. No alternative mitigations or workarounds are indicated in the advisory.