This vulnerability in Oracle BI Publisher's BI Platform Security component allows a low privileged attacker with network access via HTTP to compromise the system. The attacker can gain unauthorized capabilities including creation, deletion, or modification of critical data, full access to all Oracle BI Publisher accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vulnerability affects specific versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 new security patches across multiple products including Oracle BI Publisher.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle BI Publisher. Attackers can gain unauthorized access to all accessible data, potentially compromising confidentiality and integrity. Additionally, attackers can cause a partial denial of service, impacting availability. The CVSS score of 8.3 reflects a high impact on confidentiality and integrity, with a lower but notable impact on availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the security patches provided in this update without delay. Oracle recommends remaining on actively-supported versions and promptly applying available patches to mitigate this vulnerability. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for detailed patch availability and installation instructions.