CVE-2025-50060: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2025-50060 is an improper access control vulnerability (CWE-284) in the Web Server component of Oracle BI Publisher, part of the Oracle Analytics product family. Affected versions are 7.6.0.0.0, 8.2.0.0.0, and 12.2.1.4.0. The vulnerability was publicly disclosed on July 15, 2025, as part of Oracle's July 2025 Critical Patch Update. It carries a CVSS v3.1 base score of 8.1 (High) (Oracle Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the Web Server component of Oracle BI Publisher. A low-privileged attacker with network access via HTTP can exploit this flaw without requiring user interaction, bypassing authorization controls to perform unauthorized operations on data. The attack complexity is low and no special conditions beyond a valid low-privilege account are required, making exploitation straightforward for any authenticated user (Oracle Advisory). No public proof-of-concept or detailed technical write-up has been identified at this time.

Successful exploitation allows a low-privileged attacker to gain unauthorized read access to critical or all Oracle BI Publisher accessible data (high confidentiality impact), as well as unauthorized creation, deletion, or modification of critical data (high integrity impact). Availability is not impacted. Given that BI Publisher often handles sensitive enterprise reporting data including financial, HR, and operational reports, unauthorized access or manipulation could have significant business consequences (Oracle Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The EPSS score is approximately 0.031%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the lack of known exploitation, the low attack complexity and low privilege requirement make this an easily exploitable vulnerability once an attacker has any valid account.

Oracle has released patches for all affected versions (7.6.0.0.0, 8.2.0.0.0, and 12.2.1.4.0) as part of the July 2025 Critical Patch Update, released on July 15, 2025. Organizations should apply the relevant patches immediately, prioritizing internet-facing or externally accessible BI Publisher instances. As a temporary measure, Oracle recommends blocking network access to the affected HTTP interface for users who do not require it, though this may impact functionality and is not a long-term solution (Oracle Advisory).