---
id: "CVE-2026-91526"
kind: "vulnerability"
aliases: ["CVE-2026-91526"]
title: "Oracle BI Publisher web server flaw allows limited data read and change"
severity: "medium"
cvss: 4.7
epss: 0.00194
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-analytics", "oracle-bi-publisher", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:20:56+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91526", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91526", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle BI Publisher web server flaw allows limited data read and change

Oracle BI Publisher's Web Server component has a flaw that an unauthenticated network attacker can trigger over HTTP, provided a person other than the attacker takes an action. A successful attack can read a subset of data and update, insert or delete some accessible data in Oracle BI Publisher.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BI Publisher version against the affected list in the advisory: `8.2.0.0.0`, `12.2.1.4.0` and `26.01.0.0.0`.
- Confirm whether the BI Publisher web server is reachable from untrusted networks.

## Fix

- Apply the Oracle Critical Patch Update fix for BI Publisher listed in the Oracle advisory (version unknown from these sources).

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91526
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91526

## From the sources

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_