CVE-2026-71057

HighCVSS 8.5

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Vulnerability in Oracle BI Publisher (component: BI Platform Security) affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. A low-privileged attacker can via HTTP gain unauthorized access to critical data or all data accessible in Oracle BI Publisher and cause a partial denial of service. Attacks may impact additional products (scope change).

Risk Assessment

Risk includes confidentiality breach and partial service unavailability, potentially affecting other products in the environment.

Recommendation

Apply vendor-provided patches for affected versions and restrict HTTP access to trusted users.

Original NVD description (English source)

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).