CVE-2026-60673: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2026-60673 is an information disclosure vulnerability in the XML Services component of Oracle BI Publisher, part of the Oracle Analytics product family. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update (CPU). It carries a CVSS v3.1 base score of 6.5 (Medium), reflecting a network-exploitable, low-complexity flaw requiring only low privileges (Oracle Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper authorization or access controls within the XML Services component of Oracle BI Publisher. An attacker with low-level network access via HTTP can exploit this flaw to bypass authorization checks and gain unauthorized read access to data processed by the BI Publisher service. No user interaction is required, and attack complexity is low, making it straightforward to exploit once valid credentials are obtained. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory, Feedly).

Successful exploitation results in a high confidentiality impact, allowing a low-privileged attacker to gain unauthorized access to critical data or complete access to all data accessible to Oracle BI Publisher. Integrity and availability are not affected by this vulnerability. Given that BI Publisher is commonly used to generate and distribute sensitive business reports, the exposure of such data could have significant consequences for organizations relying on it for financial, operational, or compliance reporting (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.355%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Oracle's own SSVCv2 assessment notes the exploitation likelihood as "none" and technical impact as "partial" (Oracle Advisory).

Oracle has released patches for all affected versions (8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) as part of the July 2026 Critical Patch Update. Organizations should apply the relevant patches immediately by following the Oracle Analytics patch availability documentation linked from the CPU advisory. As a temporary compensating control, Oracle recommends restricting network access to Oracle BI Publisher to only authorized users and networks, and reviewing access control configurations and audit logs for any signs of unauthorized data access. Oracle strongly advises against relying on network-level blocking as a long-term solution (Oracle Advisory).