CVE-2026-60173: Oracle BI Publisher Auth Bypass Flaw

CVE-2026-60173 Overview

CVE-2026-60173 is a critical access control vulnerability [CWE-284] in the Oracle BI Publisher product of Oracle Analytics, specifically in the BI Platform Security component. The flaw affects supported versions 8.2.0.0.0 and 12.2.1.4.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity to fully compromise Oracle BI Publisher. Successful exploitation results in complete takeover of the affected instance, with high impact to confidentiality, integrity, and availability.

Critical Impact
Unauthenticated remote attackers can take over Oracle BI Publisher instances over HTTP without user interaction, exposing all reporting data and enabling lateral movement into connected data sources.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle Analytics (BI Platform Security component)

Discovery Timeline

2026-07-21 - CVE-2026-60173 published to NVD
2026-07-21 - Oracle discloses vulnerability in the Oracle July 2026 Security Alert
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60173

Vulnerability Analysis

The vulnerability resides in the BI Platform Security component of Oracle BI Publisher, which handles authentication and authorization for the reporting server. Improper access control [CWE-284] allows requests to reach privileged functionality without validating the caller's identity or permissions.

Because the attack vector is network-based over HTTP and requires no privileges or user interaction, an attacker only needs reachability to the BI Publisher web endpoint. Oracle BI Publisher typically runs alongside sensitive enterprise reporting workloads, with connections to databases, data warehouses, and identity providers. A takeover therefore extends beyond the application to the underlying data supply chain.

The EPSS score for this CVE is 0.486%, but the combination of unauthenticated access, network vector, and full impact triad makes it a priority patching target regardless of near-term exploitation probability.

Root Cause

The root cause is improper access control within the BI Platform Security layer. Authorization checks are either missing or bypassable on request paths that expose administrative or data-handling functionality. Oracle has not published implementation-level details, consistent with its Critical Patch Update disclosure practice.

Attack Vector

An attacker sends crafted HTTP requests to an exposed BI Publisher endpoint. Because authentication is not required, exploitation is possible directly from the internet against internet-facing deployments, or from any internal network segment that can reach the server. Refer to the Oracle July 2026 Security Alert for vendor-authoritative technical context.

// No verified public exploit code is available at time of writing.
// Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-60173

Indicators of Compromise

Unauthenticated HTTP requests to Oracle BI Publisher endpoints such as /xmlpserver/ returning HTTP 200 responses instead of redirects to authentication.
New or unexpected report templates, data models, or scheduled jobs created without a corresponding administrator session.
Outbound connections from the BI Publisher host to unfamiliar external IP addresses or non-standard ports.
Anomalous access to configured database data sources originating from the BI Publisher service account.

Detection Strategies

Review web server and application logs for requests to BI Publisher URIs that lack a valid session cookie yet return successful status codes.
Correlate BI Publisher process activity with unexpected child processes such as shells, scripting engines, or file transfer utilities.
Baseline normal report execution patterns and alert on off-hours execution or bulk data extraction jobs.

Monitoring Recommendations

Enable verbose auditing on the BI Platform Security component and forward logs to a centralized SIEM.
Monitor egress traffic from BI Publisher hosts, since data exfiltration is a likely post-exploitation objective.
Track file system writes under BI Publisher installation and temporary directories for uploaded artifacts or webshells.

How to Mitigate CVE-2026-60173

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all Oracle BI Publisher 8.2.0.0.0 and 12.2.1.4.0 deployments.
Restrict network access to BI Publisher endpoints so they are not reachable from the public internet or untrusted network segments.
Rotate credentials used by BI Publisher to connect to databases and identity providers if exposure is suspected.
Review audit logs for unauthenticated access attempts predating the patch deployment.

Patch Information

Oracle addressed CVE-2026-60173 in the July 2026 Critical Patch Update. Administrators should consult the Oracle July 2026 Security Alert for patch identifiers and version-specific installation instructions. Oracle patches for BI Publisher are cumulative and should be applied through the standard OPatch process on the Fusion Middleware home.

Workarounds

Place BI Publisher behind a reverse proxy or web application firewall that enforces authentication before requests reach the application.
Apply IP allow-listing at the network layer to limit access to known administrator and reporting-user networks.
Disable internet exposure of the BI Publisher management interface until patching is complete.

bash

# Example: restrict access to BI Publisher at the firewall layer (iptables)
iptables -A INPUT -p tcp --dport 9502 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP