---
id: "CVE-2026-91579"
kind: "vulnerability"
aliases: ["CVE-2026-91579"]
title: "Oracle BI Publisher: unauthenticated network flaw allows full takeover"
severity: "high"
cvss: 8.8
epss: 0.00234
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle BI Publisher", "fixed": [], "affected": "8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-analytics", "oracle-bi-publisher", "other", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:21:00+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91579", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:52:04+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91579", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle BI Publisher: unauthenticated network flaw allows full takeover

Oracle BI Publisher (Oracle Analytics, BI Platform Security component) has an unauthenticated HTTP flaw (CVSS 8.8, UI required) that can lead to full takeover of the product. Fixed by Oracle's October 2026 Critical Patch Update. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle BI Publisher affected 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 fixed ?

## How to check

Check whether you run Oracle BI Publisher / Oracle Analytics at 8.2.0.0.0, 12.2.1.4.0 or 26.1.0.0.0 (NVD writes 26.01.0.0.0) and whether the October 2026 CPU patch is applied (OPatch lsinventory on the Oracle home). Exposed if BI Publisher's HTTP interface is reachable by users who could be lured into interaction.

## Fix

Apply the Oracle October 2026 CPU patch for Oracle Analytics (BI Publisher) from the patch availability document on My Oracle Support. Exact patch number unknown (MOS login required). Until then, restrict network access to the BI Publisher HTTP interface to trusted networks.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91579
- 2026-10-23T23:52:04+00:00 analyst — Oracle Oct 2026 CPU (cpuoct2026.html) lists BI Publisher 8.2.0.0.0, 12.2.1.4.0, 26.1.0.0.0 (NVD writes 26.01.0.0.0) as affected; fix is the Oct 2026 CPU patch via the Oracle Analytics MOS patch availability doc (login-gated), no fixed version number or patch ID public. No exploitation or PoC found, no X chatter (count 0). Could not retrieve the Analytics risk matrix row in the verbose page (truncated); the NVD page returned empty.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91579

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] CVE-2026-91579 | Armis https://cve.armis.com/CVE-2026-91579

## From the sources

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_