CVE-2026-71057 in BI Publisher
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting Oracle BI Publisher versions including 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0. This security flaw is characterized by its susceptibility to exploitation via network-accessible HTTP protocols, allowing attackers with low privileges to compromise the integrity of the BI Publisher environment. The presence of this vulnerability indicates a significant weakness in how the application handles authentication or authorization checks for specific endpoints or data retrieval mechanisms. Because the attack vector requires only low-privileged access and no user interaction, it represents a high-risk scenario where even basic authenticated users can escalate their privileges or manipulate system behavior beyond intended boundaries.
The operational impact of this vulnerability is severe due to its broad scope and potential for cascading effects within an organization's data infrastructure. Successful exploitation enables unauthorized access to critical business intelligence reports, dashboards, and underlying datasets that are typically protected by role-based access controls. This leads to a high level of confidentiality compromise as sensitive corporate information can be exfiltrated without detection or permission. Furthermore, the vulnerability allows for partial denial of service conditions, which disrupts availability by consuming system resources or causing application instability through malformed requests or excessive processing loads triggered by malicious inputs. The impact extends beyond BI Publisher itself due to scope changes, meaning that adjacent systems relying on shared authentication tokens or integrated data sources may also be compromised, thereby widening the blast radius of a single successful attack.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-352 Cross-Site Request Forgery if HTTP request manipulation is involved, though the primary concern remains unauthorized access leading to data exposure. In terms of adversary tactics, it maps closely to ATT&CK technique T1078 Valid Accounts, where attackers leverage existing low-level credentials to gain deeper access, and potentially T1496 Resource Hijacking or T1529 System Shutdown/Reboot if the denial-of-service aspect involves crashing services. The CVSS 3.1 base score of 8.5 reflects these high impacts on confidentiality and availability with a relatively easy attack complexity. Attackers can exploit this over standard HTTP ports, making it accessible from remote networks without requiring physical proximity or complex social engineering tactics.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle BI Publisher as provided by Oracle Security Alerts. Organizations should also implement strict network segmentation to limit access to BI Publisher interfaces only through trusted IP ranges and enforce multi-factor authentication for all administrative and privileged user accounts. Web Application Firewalls can be configured to detect and block anomalous HTTP request patterns associated with this vulnerability, such as unusual parameter sizes or specific header manipulations that trigger the denial-of-service condition. Additionally, auditing logs should be reviewed regularly to identify any signs of unauthorized data access attempts or resource exhaustion events indicative of exploitation activity before a patch is applied.