This vulnerability affects Oracle BI Publisher 12.2.1.4.0 and allows an attacker with low privileges and network access via HTTP to compromise the system. The scope of impact may extend to additional Oracle products due to the interconnected nature of Oracle Analytics components. Exploitation can result in unauthorized access to sensitive data and partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

The vulnerability enables unauthorized access to critical or all data accessible by Oracle BI Publisher and can cause partial denial of service, impacting confidentiality and availability. The scope change indicates potential impact on other Oracle products integrated with BI Publisher. The CVSS score of 8.5 confirms a high severity threat primarily affecting confidentiality and availability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle BI Publisher version 12.2.1.4.0 should apply the provided patches promptly to remediate the vulnerability. Oracle strongly recommends maintaining actively supported versions and applying security patches without delay to prevent exploitation. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.