CVE-2026-60719 in BI Publisher
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle BI Publisher's Web Service API component within the Oracle Analytics suite, representing a critical security weakness that affects specific version ranges including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The flaw manifests as an easily exploitable security gap that enables attackers with minimal privileges and network access through HTTP protocols to compromise the target system. The vulnerability's classification as low privilege attack vector means that even users with limited access rights can potentially exploit this weakness, making it particularly dangerous for organizations where user access controls may not be strictly enforced. The security implications extend beyond the immediate Oracle BI Publisher application as indicated by the scope change aspect of the vulnerability, suggesting that successful exploitation could affect additional connected products within the Oracle ecosystem.
The technical nature of this vulnerability allows attackers to perform unauthorized operations on Oracle BI Publisher data including creation, deletion, and modification activities against critical information systems. This represents a severe compromise of data integrity and confidentiality aspects as malicious actors could alter or destroy important business intelligence data while also gaining access to sensitive information that should remain protected. The partial denial of service capability adds another dimension to the attack surface, potentially disrupting business operations by making critical reporting and analytics services unavailable to legitimate users. According to CVSS 3.1 scoring methodology, this vulnerability achieves a base score of 9.9, reflecting the highest severity classification with high impacts across confidentiality, integrity, and availability domains. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) clearly indicates network-based exploitation requires low attack complexity, only minimal privileges, no user interaction, and results in a scope change that affects additional systems while causing high impact on both confidentiality and integrity aspects.
From an operational perspective, this vulnerability creates significant risk for organizations relying on Oracle BI Publisher for business intelligence reporting and data analysis. The combination of unauthorized data modification capabilities with partial denial of service potential means that attackers could not only corrupt critical business data but also disrupt operational workflows that depend on timely access to analytical reports. The scope change characteristic implies that exploitation might extend beyond the immediate target application to affect related Oracle products, potentially creating cascading security issues throughout the enterprise infrastructure. Organizations utilizing these affected versions should consider this vulnerability as a high-priority threat requiring immediate attention and remediation efforts.
Security practitioners should reference CWE-284 for access control vulnerabilities and consider ATT&CK techniques related to privilege escalation and data manipulation when developing defensive strategies. The low attack complexity combined with minimal privilege requirements makes this vulnerability particularly attractive to automated attack tools, increasing the potential for widespread exploitation across organizations that have not yet patched their systems. Mitigation efforts should focus on immediate patch deployment, network segmentation to limit access to the Web Service API, and implementation of robust monitoring solutions to detect unauthorized access attempts or data modification activities. Regular security assessments and vulnerability scanning should be implemented to identify any similar weaknesses in other Oracle products within the organization's infrastructure.