This vulnerability affects Oracle BI Publisher's Web Service API component and is exploitable remotely via SOAP by an attacker with low privileges. The CVSS 3.1 base score is 8.1, reflecting high impact on integrity and availability but no confidentiality impact. Successful exploitation allows unauthorized modification or deletion of critical data and can cause repeated application crashes leading to denial of service. The affected versions explicitly identified are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle's September 2026 Critical Security Patch Update addresses this vulnerability among many others, and Oracle strongly recommends applying these patches without delay.

The vulnerability enables unauthorized modification, creation, or deletion of critical data within Oracle BI Publisher, potentially compromising data integrity. It also allows an attacker to cause repeated application crashes or hangs, resulting in denial of service. There is no direct confidentiality impact reported. The overall impact is high due to the integrity and availability consequences.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 should apply these patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.