This vulnerability in Oracle BI Publisher 12.2.1.4.0's Web Service API allows an attacker with low privileges and network access via SOAP to compromise the system. The attack can result in unauthorized access to critical data or complete access to all data accessible through Oracle BI Publisher. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted fixes for this and other vulnerabilities across multiple Oracle products.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle BI Publisher, compromising confidentiality. There is no impact on integrity or availability. The vulnerability may also affect additional Oracle products due to scope change. The CVSS score of 7.7 reflects a high severity confidentiality impact.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle BI Publisher version 12.2.1.4.0 should apply the relevant security patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.