---
id: "CVE-2026-91554"
kind: "vulnerability"
aliases: ["CVE-2026-91554"]
title: "Oracle BI Publisher 12.2.1.4.0: unauthenticated HTTP flaw exposes and alters some data"
severity: "medium"
cvss: 6.5
epss: 0.00205
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise", "oracle-analytics", "oracle-bi-publisher", "vendor"]
not_affected_if: ["no-network-access", "other-version"]
published_at: "2026-10-20T22:20:58+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91554", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91554", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle BI Publisher 12.2.1.4.0: unauthenticated HTTP flaw exposes and alters some data

Oracle BI Publisher 12.2.1.4.0 has a flaw in its Web Server component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. The CVSS 3.1 base score is 6.5 with confidentiality and integrity impact and no availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed version of Oracle BI Publisher is `12.2.1.4.0`
- Check whether the BI Publisher web endpoints are reachable from untrusted networks
- unknown for other checks: the sources do not describe specific endpoints or settings

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle BI Publisher `12.2.1.4.0`; the sources do not name the patch number
- unknown for any other mitigation: the sources do not say

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91554
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91554

## From the sources

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_