This vulnerability affects Oracle BI Publisher's BI Platform Security component and is exploitable via network access through SOAP by an attacker with low privileges. Successful exploitation results in high integrity and availability impacts, specifically unauthorized data manipulation and denial of service conditions. The CVSS 3.1 base score is 8.1, reflecting the ease of exploitation (low attack complexity, no user interaction) and significant impact on data integrity and service availability. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability, and customers are urged to apply these patches without delay.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data or all data accessible by Oracle BI Publisher. Additionally, the attacker can cause the application to hang or crash repeatedly, resulting in a complete denial of service. This compromises data integrity and availability but does not affect confidentiality.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.