CVE-2026-91555 in BI Publisher
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Server component of Oracle BI Publisher, a critical module in the Oracle Analytics suite that facilitates business intelligence reporting and data visualization. This flaw affects specific legacy and current versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The core technical issue stems from a design or implementation error that permits unauthenticated actors to interact with the web server interface via standard HTTP protocols without requiring prior authentication credentials. This lack of proper access control mechanisms allows external entities to send crafted requests directly to vulnerable endpoints, bypassing intended security boundaries and initiating malicious operations against the underlying data structures managed by the application.
From a technical perspective, this vulnerability is classified under CWE-287, which denotes Improper Authentication, as it allows an attacker who has not been authenticated to perform actions that should be restricted to authorized users. Furthermore, because the successful exploitation requires human interaction from a victim other than the initial attacker, such as clicking on a malicious link or opening a specially crafted document generated by the BI Publisher tooling, this aligns with CWE-840, Permissive Validation of User-supplied Input in conjunction with social engineering vectors often associated with CWE-79. The requirement for user interaction suggests that while the vulnerability is technically exploitable over the network, it relies on a degree of social engineering or targeted delivery to trigger the actual exploit chain within the browser context or application logic.
The operational impact of this vulnerability extends beyond the immediate compromise of Oracle BI Publisher due to scope change characteristics inherent in modern web applications and integrated analytics platforms. Successful exploitation results in unauthorized read access to a subset of accessible data, which constitutes a significant confidentiality breach as sensitive business intelligence reports, customer metrics, or financial projections could be exfiltrated. Additionally, the vulnerability permits unauthorized update, insert, or delete operations against certain datasets within the BI Publisher environment. This integrity impact allows attackers to alter report configurations, inject malicious content into published documents, or destroy critical data assets, thereby undermining the reliability and trustworthiness of the entire analytics infrastructure.
The broader organizational risk is amplified by the fact that attacks may significantly impact additional products beyond Oracle BI Publisher itself. In integrated enterprise environments where BI tools share databases with ERP systems, CRM platforms, or other mission-critical applications, compromising the integrity or confidentiality of shared data can lead to cascading failures across multiple business functions. The CVSS 3.1 base score of 6.1 reflects a medium severity rating driven by network accessibility and low attack complexity but tempered by the requirement for user interaction and limited availability impact. However, in high-value target scenarios, even partial data compromise or integrity violation can have severe financial and reputational consequences.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle Analytics where these flaws are resolved. Organizations should also implement strict network segmentation to restrict HTTP access to BI Publisher components from untrusted networks, ensuring that only authenticated users from authorized IP ranges can reach the web server interface. Deploying Web Application Firewalls with rulesets tuned for common injection and authentication bypass patterns can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Furthermore, enforcing multi-factor authentication and rigorous input validation across all user-facing interfaces reduces the likelihood that human interaction will successfully trigger the vulnerability. Regular security audits and penetration testing focused on access control mechanisms are essential to identify similar weaknesses in related modules within the Oracle Analytics ecosystem.