This vulnerability exists in the BI Platform Security component of Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an attacker with low privileges and network access via HTTP to compromise Oracle BI Publisher, potentially gaining unauthorized access to critical or all data accessible by the product. The vulnerability has a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes patches for this and many other vulnerabilities, and Oracle strongly recommends applying these patches promptly.

Exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible through Oracle BI Publisher. The confidentiality of sensitive information is at high risk, while integrity and availability are not impacted. Due to scope change, other Oracle products may also be affected indirectly by attacks exploiting this vulnerability.

Oracle has released security patches for this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. Oracle recommends remaining on actively-supported versions and promptly applying all security patches. No additional mitigation steps are specified beyond patching.