Threats affecting pkg:maven/com.oracle.bi/bi-publisher

A vulnerability exists in Oracle BI Publisher 12.2.1.4.0 within the Web Service API component. This flaw allows a low-privileged attacker with network access via SOAP to compromise the system, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update.