CVE-2026-60173 in BI Publisher
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This critical vulnerability exists within Oracle BI Publisher's security framework, specifically within the BI Platform Security component of Oracle Analytics. The flaw affects two major version lines including 8.2.0.0.0 and 12.2.1.4.0, representing a significant attack surface for malicious actors targeting enterprise business intelligence platforms. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to leverage this weakness effectively.
The technical nature of this flaw allows unauthenticated attackers to compromise Oracle BI Publisher through standard HTTP network connections without requiring any prior authentication credentials or privileged access. This represents a fundamental breakdown in the platform's security architecture, as the system fails to properly validate incoming requests or implement adequate access controls for critical components. The vulnerability's CVSS 3.1 score of 9.8 places it in the critical severity category, reflecting the high potential impact across all three core security principles.
The operational consequences of successful exploitation are severe and far-reaching, potentially enabling full system compromise and complete takeover of the Oracle BI Publisher environment. This level of control would allow attackers to manipulate or exfiltrate sensitive business intelligence data, modify report configurations, and potentially use the compromised platform as a launch point for further attacks within the enterprise network. The confidentiality, integrity, and availability impacts are all rated as high, indicating that the vulnerability could affect all aspects of the system's security posture.
This vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and maps to ATT&CK technique T1078 for valid accounts and T1566 for malicious file execution. Organizations should implement immediate network segmentation measures to limit access to the affected BI Publisher instances, deploy web application firewalls to monitor and filter HTTP traffic, and ensure all systems are patched according to Oracle's security bulletins. The lack of authentication requirements makes this particularly dangerous in environments where the BI Publisher is exposed to untrusted networks or the internet without proper protective controls.
The attack vector analysis reveals that network-based exploitation requires only basic HTTP connectivity, making this vulnerability particularly concerning for organizations with minimal network controls or those exposing their business intelligence platforms directly to external networks. Standard security monitoring should include detection of unusual HTTP request patterns and unauthorized access attempts to BI Publisher endpoints. Remediation efforts must prioritize immediate patching of affected systems while implementing comprehensive security assessments of the entire Oracle Analytics environment to identify potential additional vulnerabilities or misconfigurations that could compound the risk profile.