CVE-2025-61754: 
Oracle Analytics Publisher vulnerability analysis and mitigation

A vulnerability in Oracle BI Publisher's Web Service API component affects versions 7.6.0.0.0 and 8.2.0.0.0. This easily exploitable vulnerability (CVE-2025-61754) allows low-privileged attackers with network access via HTTP to compromise Oracle BI Publisher. The vulnerability was disclosed on October 21, 2025 (NVD, Oracle Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The scoring indicates network-based attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and high impact on confidentiality but no impact on integrity or availability (NVD).

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. The vulnerability primarily affects the confidentiality of data, with no reported impacts on system integrity or availability (Oracle Advisory).

The vulnerability is considered easily exploitable by attackers with low privileges who have network access via HTTP. No user interaction is required for exploitation, making it a potentially attractive target for attackers (NVD).

Oracle has released patches for this vulnerability as part of the October 2025 Critical Patch Update. Organizations running affected versions (7.6.0.0.0 and 8.2.0.0.0) should apply the security patches as soon as possible (Oracle Advisory).