{"id":"CVE-2026-91554","kind":"vulnerability","aliases":["CVE-2026-91554"],"related":[],"title":"Oracle BI Publisher 12.2.1.4.0: unauthenticated HTTP flaw exposes and alters some data","description":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","summary":"Oracle BI Publisher 12.2.1.4.0 has a flaw in its Web Server component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. The CVSS 3.1 base score is 6.5 with confidentiality and integrity impact and no availability impact.","severity":"medium","cvss":6.5,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","oracle-analytics","oracle-bi-publisher","vendor"],"not_affected_if":["no-network-access","other-version"],"how_to_check":"- Confirm the installed version of Oracle BI Publisher is `12.2.1.4.0`\n- Check whether the BI Publisher web endpoints are reachable from untrusted networks\n- unknown for other checks: the sources do not describe specific endpoints or settings","fix":"- Apply the Oracle Critical Patch Update fix for Oracle BI Publisher `12.2.1.4.0`; the sources do not name the patch number\n- unknown for any other mitigation: the sources do not say","status":"open","published_at":"2026-10-20T22:20:58+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:49:19+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:19Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle BI Publisher `12.2.1.4.0`; the sources do not name the patch number\n- unknown for any other mitigation: the sources do not say","reach":"internet","title":"Oracle BI Publisher 12.2.1.4.0: unauthenticated HTTP flaw exposes and alters some data","impact":"medium","summary":"Oracle BI Publisher 12.2.1.4.0 has a flaw in its Web Server component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. The CVSS 3.1 base score is 6.5 with confidentiality and integrity impact and no availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-bi-publisher","oracle-analytics","enterprise"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads and alters some BI Publisher data","analyst_note":"Check the Oracle Security Alert advisory for the patch number and any configuration conditions; the NVD entry alone does not say how to check or fix.","how_to_check":"- Confirm the installed version of Oracle BI Publisher is `12.2.1.4.0`\n- Check whether the BI Publisher web endpoints are reachable from untrusted networks\n- unknown for other checks: the sources do not describe specific endpoints or settings","needs_analyst":true,"not_affected_if":["other-version","no-network-access"],"who_is_affected":"Teams running Oracle BI Publisher 12.2.1.4.0 as part of Oracle Analytics whose HTTP endpoints can be reached over the network. The sources do not say which configurations are exposed beyond the affected version and network access. Teams on other versions or with no network path to the service can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":3487,"output_tokens":686,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91554':15A,18A '/av':163C '12.2.1.4.0':4A,31B,96C '3.1':62B,151C,162C '6.5':66B,154C 'access':51B,105C,126C,133C,140C,148C 'affect':94C 'allow':100C 'alter':10A 'analyt':22B,85C 'attack':44B,102C,114C 'avail':74B 'base':63B,152C 'bi':2A,25B,29B,80C,111C,131C,146C 'compon':39B,86C 'compromis':109C 'confidenti':68B,155C 'cve':13A,16A 'cvss':61B,150C,159C,161C 'data':12A,52B,134C,149C 'delet':56B,125C 'easili':97C 'enterpris':19B 'exploit':98C 'expos':8A 'flaw':7A,34B 'http':6A,46B,107C 'impact':71B,75B,158C 'insert':123C 'integr':70B,157C 'l/a':170C 'l/i':169C 'l/pr':165C 'let':41B 'modifi':54B 'n':171C 'n/ac':164C 'n/s':167C 'n/ui':166C 'network':104C 'oracl':1A,21B,24B,28B,79C,84C,110C,130C,145C 'oracle-analyt':20B 'oracle-bi-publish':23B 'product':82C 'publish':3A,26B,30B,81C,112C,132C,147C 'read':47B,139C 'result':119C 'score':64B,153C 'server':38B,88C 'subset':49B,143C 'success':113C 'support':90C 'u/c':168C 'unauthent':5A,43B,101C 'unauthor':121C,138C 'updat':122C 'vector':160C 'vendor':27B 'version':91C 'via':106C 'vulner':76C,99C,117C 'web':37B,87C 'well':136C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle BI Publisher 12.2.1.4.0 as part of Oracle Analytics whose HTTP endpoints can be reached over the network. The sources do not say which configurations are exposed beyond the affected version and network access. Teams on other versions or with no network path to the service can likely skip it, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91554","severity":null,"published_at":"2026-10-20T22:20:58+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91554","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91554","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}