This vulnerability exists in the Oracle BI Publisher component of Oracle Analytics, specifically in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to compromise Oracle BI Publisher, resulting in unauthorized access to critical data or complete access to all data accessible by Oracle BI Publisher. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including for Oracle BI Publisher.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle BI Publisher. The confidentiality of sensitive information is at high risk. There is no impact on integrity or availability according to the CVSS vector. The vulnerability's scope change means it may affect additional Oracle products relying on Oracle BI Publisher.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.