This vulnerability in Oracle BI Publisher (component: BI Platform Security) is exploitable by a low privileged attacker with network access via SOAP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle BI Publisher, along with unauthorized read access to a subset of data. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can allow an attacker with low privileges and network access to perform unauthorized creation, deletion, or modification of critical data in Oracle BI Publisher, as well as unauthorized read access to some data. The scope of impact may extend to additional products due to the integration of Oracle BI Publisher. The CVSS score of 8.5 reflects a high impact on confidentiality and integrity, with no impact on availability.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.