CVE-2026-71058: High severity Oracle Oracle BI Publisher vulnerability
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle BI Publisher Web Service API (HTTP) so only trusted clients can reach it (e.g., block/limit inbound HTTP at a firewall or reverse proxy) to mitigate exploitation via network access.
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize Oracle BI Publisher deployments running supported affected versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0, particularly where the Web Service API is reachable over HTTP from untrusted or broadly accessible networks.
What level of access does an attacker need?
An attacker needs network access via HTTP and low-privileged credentials. No user interaction is required, and exploitation is described as easily achievable.
What is the potential operational impact of a successful attack?
A successful attack can result in takeover of Oracle BI Publisher, with high impact to confidentiality, integrity, and availability.