CVE-2026-71058 in BI Publisher
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Web Service API component of Oracle BI Publisher, a critical module within the broader Oracle Analytics suite. This flaw affects specific legacy and current versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The nature of this vulnerability is particularly severe because it allows for remote code execution or complete system compromise without the need for user interaction or high-level privileges. An attacker with low privileged access who has network connectivity to the target system via HTTP can exploit this weakness to gain unauthorized control over the Oracle BI Publisher environment. This represents a significant escalation from standard data exposure, as the ability to take over the application effectively grants the adversary full administrative capabilities within that context.
From a technical perspective, the vulnerability is classified under CWE-287, which denotes Improper Authentication, and potentially CWE-94, Code Injection, depending on the specific mechanism by which the Web Service API fails to validate inputs or enforce access controls correctly. The low attack complexity and lack of required user interface interaction mean that automated exploitation tools can easily leverage this flaw across a network. The availability of an HTTP-based vector further expands the attack surface, allowing remote adversaries located outside the internal perimeter to initiate attacks if firewall rules permit traffic on the relevant ports. This aligns with ATT&CK technique T1078, Valid Accounts, as low-privileged credentials are sufficient for exploitation, and potentially T1190, Exploit Public-Facing Application, given the web service nature of the component.
The operational impact of this vulnerability is catastrophic due to its high severity rating. With a CVSS 3.1 base score of 8.8, the flaw impacts confidentiality, integrity, and availability equally. A successful exploitation leads to complete takeover of Oracle BI Publisher, which often serves as a central hub for reporting, data visualization, and enterprise information distribution. Compromise at this level allows attackers to exfiltrate sensitive corporate data, modify reports or dashboards to mislead stakeholders, or use the compromised server as a pivot point for further lateral movement within the network. The ability to execute arbitrary code on the host system running BI Publisher also opens the door for installing malware, establishing persistence mechanisms, and disrupting business operations by rendering reporting services unavailable.
Mitigation strategies must prioritize immediate patching of all affected versions using official updates provided by Oracle Security Alerts. Organizations should verify their inventory against the supported version list to ensure that systems are updated to a non-vulnerable release. In cases where immediate patching is not feasible, network segmentation and strict firewall rules should be implemented to restrict access to the BI Publisher Web Service API endpoints exclusively from trusted internal subnets or specific application servers. Additionally, enforcing multi-factor authentication for all administrative accounts and implementing robust input validation at the proxy level can help mitigate exploitation attempts. Regular vulnerability scanning focused on web service APIs is recommended to detect any unpatched instances before they are targeted by automated threat actors exploiting this known weakness.