---
id: "CVE-2019-2616"
kind: "vulnerability"
aliases: ["CVE-2019-2616"]
title: "Oracle BI Publisher (Formerly XML Publisher): Oracle BI Publisher Unauthorized Access Vulnerability"
severity: "high"
cvss: 7.2
epss: 0.92183
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Oracle BI Publisher (Formerly XML Publisher)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterprise", "exploited", "oracle-bi-publisher", "self-hosted", "vendor"]
not_affected_if: ["not-deployed"]
published_at: "2019-04-23T19:32:51+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2616", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-2616", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2616", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Oracle BI Publisher (Formerly XML Publisher): Oracle BI Publisher Unauthorized Access Vulnerability

Oracle BI Publisher (formerly XML Publisher) has an unspecified flaw that allows unauthorized actions, reported as an authentication bypass. CISA lists it as actively exploited in the wild, so an attacker can likely act on the server without valid credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle BI Publisher (Formerly XML Publisher) affected ? fixed ?

## How to check

Identify whether Oracle BI Publisher is deployed and which patch level it runs; the sources do not give a version check command.

## Fix

Apply the Oracle security updates per vendor instructions, as CISA requires; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-2616
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-2616
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-2616

## From the sources

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_