{"id":"CVE-2026-91579","kind":"vulnerability","aliases":["CVE-2026-91579"],"related":[],"title":"Oracle BI Publisher: unauthenticated network flaw allows full takeover","description":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle BI Publisher (Oracle Analytics, BI Platform Security component) has an unauthenticated HTTP flaw (CVSS 8.8, UI required) that can lead to full takeover of the product. Fixed by Oracle's October 2026 Critical Patch Update. No exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle BI Publisher","fixed":[],"affected":"8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-analytics","oracle-bi-publisher","other","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Check whether you run Oracle BI Publisher / Oracle Analytics at 8.2.0.0.0, 12.2.1.4.0 or 26.1.0.0.0 (NVD writes 26.01.0.0.0) and whether the October 2026 CPU patch is applied (OPatch lsinventory on the Oracle home). Exposed if BI Publisher's HTTP interface is reachable by users who could be lured into interaction.","fix":"Apply the Oracle October 2026 CPU patch for Oracle Analytics (BI Publisher) from the patch availability document on My Oracle Support. Exact patch number unknown (MOS login required). Until then, restrict network access to the BI Publisher HTTP interface to trusted networks.","status":"open","published_at":"2026-10-20T22:21:00+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:47+00:00","updated_at":"2026-10-23T23:52:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:33:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle BI Publisher: unauthenticated network flaw allows full takeover","impact":"high","summary":"Oracle BI Publisher in Oracle Analytics has a flaw in its BI Platform Security component that lets an unauthenticated remote attacker over HTTP compromise the server. Successful attacks need a victim to interact, and the sources say the impact is full takeover of the product.","category":"other","who_cares":["oracle-analytics","oracle-bi-publisher"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the BI Publisher server over HTTP","analyst_note":"Find the affected versions' patch from Oracle's Critical Patch Update advisory and confirm which versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are fixed in, at https://nvd.nist.gov/vuln/detail/CVE-2026-91579.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000516,"input_tokens":3107,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected versions' patch from Oracle's Critical Patch Update advisory and confirm which versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are fixed in, at https://nvd.nist.gov/vuln/detail/CVE-2026-91579.","search":"'-2026':11A,14A '-91579':12A,15A '/av':149C '12.2.1.4.0':91C '2026':63B '26.01.0.0.0':93C '3.1':136C,148C '8.2.0.0.0':90C '8.8':46B,139C 'access':102C 'affect':88C 'allow':7A,97C 'analyt':21B,35B,79C 'attack':99C,111C,121C,123C 'avail':143C 'base':137C 'bi':2A,17A,24B,32B,36B,74C,81C,108C,133C 'compon':39B,80C 'compromis':106C 'confidenti':140C 'critic':64B 'cve':10A,13A 'cvss':45B,135C,145C,147C 'easili':94C 'exploit':68B,95C 'fix':58B 'flaw':6A,44B 'full':8A,53B 'h':157C 'h/a':156C 'h/i':155C 'host':30B 'http':43B,104C 'human':113C 'impact':144C 'integr':141C 'interact':114C 'l/pr':151C 'lead':51B 'n/ac':150C 'n/ui':152C 'network':5A,101C 'octob':62B 'oracl':1A,20B,23B,31B,34B,60B,73C,78C,107C,132C 'oracle':16A 'oracle-analyt':19B 'oracle-bi-publish':22B 'packag':27B 'patch':65B 'person':117C 'platform':37B,82C 'product':57B,76C 'publish':3A,25B,33B,75C,109C,134C 'publisher':18A 'r/s':153C 'report':69B 'requir':48B,112C 'result':128C 'score':138C 'secur':38B,83C 'self':29B 'self-host':28B 'success':110C,122C 'support':84C 'takeov':9A,54B,130C 'u/c':154C 'ui':47B 'unauthent':4A,42B,98C 'updat':66B 'vector':146C 'version':85C 'via':103C 'vulner':70C,96C,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91579","severity":null,"published_at":"2026-10-20T22:21:00+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91579:533","url":null,"severity":null,"published_at":"2026-10-23T23:52:04+00:00","modified_at":"2026-10-23T23:52:04+00:00","first_seen_at":"2026-10-23T23:52:04+00:00","fetched_at":"2026-10-23T23:52:04+00:00","note":"Oracle Oct 2026 CPU (cpuoct2026.html) lists BI Publisher 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 (NVD writes 26.01.0.0.0) as affected; fix is the Oct 2026 CPU patch via the Oracle Analytics MOS patch availability doc (login-gated), no fixed version number or patch ID public. No exploitation or PoC found, no X chatter (count 0). Could not retrieve the Analytics risk matrix row in the verbose page (truncated); the NVD page returned empty."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2211,"url":"https://cve.armis.com/CVE-2026-91579","title":"CVE-2026-91579 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}