This vulnerability in Oracle BI Publisher (component: BI Platform Security) allows an attacker with low privileges and network access via HTTP to compromise the product. The attack requires user interaction from a third party and can result in unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting other Oracle products. The CVSS 3.1 base score is 8.7, indicating high severity, with confidentiality and integrity impacts and no availability impact. A Critical Security Patch Update released by Oracle in September 2026 includes fixes for this vulnerability among 673 others across multiple Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle BI Publisher. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond BI Publisher. The confidentiality and integrity of data are highly impacted, but availability is not affected.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond applying the official patches.