This vulnerability affects Oracle BI Publisher in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 base score is 8.6, indicating high severity with impacts on confidentiality (high), integrity (low), and availability (low). Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical or all Oracle BI Publisher accessible data, unauthorized modification (update, insert, delete) of some data, and partial denial of service conditions. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.