CVE-2026-71057: 
Oracle Analytics Publisher vulnerability analysis and mitigation

CVE-2026-71057 is an authorization bypass vulnerability in the BI Platform Security component of Oracle BI Publisher, part of the Oracle Analytics product family. It affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. The vulnerability was disclosed and patched on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 8.5 (High), reflecting its network-exploitable nature with low privileges required and a scope change impacting additional products (Oracle Advisory, Feedly).

The vulnerability resides in the BI Platform Security component of Oracle BI Publisher and is classified as an authorization bypass (CWE not formally assigned in NVD at time of publication). An attacker with low-level network privileges can exploit this flaw over HTTP without user interaction, bypassing access controls to gain unauthorized access to sensitive data. The scope change (S:C) in the CVSS vector indicates that a successful exploit can affect resources beyond the vulnerable component itself, potentially impacting other products or services integrated with Oracle BI Publisher. No specific technical write-ups or public proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation allows a low-privileged attacker to gain unauthorized access to critical data or complete access to all data accessible by Oracle BI Publisher, representing a high confidentiality impact. Additionally, the attacker can cause a partial denial of service (partial DOS) of the BI Publisher service, affecting availability. The scope change means that connected or dependent products beyond Oracle BI Publisher itself may also be impacted, increasing the potential blast radius of a successful attack (Oracle Advisory, Feedly).

As of the disclosure date (August 18, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is reported at 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Oracle has released security patches for all affected versions (8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0) as part of the August 2026 Critical Security Patch Update, and immediate application is strongly recommended. As a temporary measure, Oracle advises restricting network access to Oracle BI Publisher to authorized users and networks only, and implementing network segmentation to limit the potential scope of compromise. Blocking HTTP access to the BI Publisher service from untrusted networks may reduce risk until patching is complete, though Oracle cautions that such workarounds are not long-term solutions and may impact application functionality (Oracle Advisory).

The vulnerability was noted by AUSCERT in their security bulletin ASB-2026.0186 and tracked by VulDB (entry 392212) shortly after Oracle's disclosure. No significant independent researcher commentary or broader media coverage has been identified at this time.