CVE-2026-71059

Analyzed Analyzed - Analysis Complete

Oracle BI Publisher Remote Code Execution

Publication date: 2026-08-18

Last updated on: 2026-08-24

Assigner: Oracle

Description

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-24

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71059

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	bi_publisher	8.2.0.0.0
oracle	bi_publisher	26.01.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle BI Publisher, part of Oracle Analytics. It allows a low-privileged attacker with network access via SOAP to take over the system. The impact includes confidentiality, integrity, and availability breaches.

Detection Guidance

This vulnerability is specific to Oracle BI Publisher and requires network access via SOAP. Detection involves checking for Oracle BI Publisher versions 8.2.0.0.0 or 26.1.0.0.0 and monitoring for unusual SOAP requests targeting the Web Service API component.

Impact Analysis

An attacker could exploit this to gain full control over Oracle BI Publisher, potentially leading to data theft, unauthorized modifications, or service disruption. Additional products may also be affected.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Compliance may be compromised due to potential loss of sensitive information.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle BI Publisher versions 8.2.0.0.0 and 26.1.0.0.0. Restrict network access to the SOAP API endpoint and limit privileges for users accessing the system. Monitor for unusual activity in Oracle BI Publisher logs.

Hi! I’m here to help you understand CVE-2026-71059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70