CVE-2026-60719 Overview
CVE-2026-60719 is a critical vulnerability in the Web Service API component of Oracle BI Publisher, part of Oracle Analytics. Affected versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access over HTTP can compromise Oracle BI Publisher. The flaw carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Attackers can gain unauthorized read, write, and delete access to Oracle BI Publisher data and cause a partial denial of service. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
An authenticated network attacker can compromise the confidentiality and integrity of all BI Publisher data and impact adjacent products through scope change.
Affected Products
- Oracle BI Publisher 8.2.0.0.0
- Oracle BI Publisher 12.2.1.4.0
- Oracle BI Publisher 26.01.0.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60719 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle releases fix in the Oracle Critical Patch Update July 2026
Technical Details for CVE-2026-60719
Vulnerability Analysis
CVE-2026-60719 resides in the Web Service API of Oracle BI Publisher. The API exposes report generation and data source functions to authenticated clients over HTTP. A low-privileged account is sufficient to reach the vulnerable endpoints. The scope change indicator means the vulnerable component and the impacted component differ, so exploitation can pivot into other Oracle Analytics resources that trust BI Publisher.
Successful exploitation results in full read access to all data accessible to BI Publisher, unauthorized creation and modification of data, and a partial disruption of service availability. Oracle classifies the flaw as easily exploitable and provides a fix in the July 2026 Critical Patch Update.
Root Cause
Oracle has not published a detailed root cause analysis. Based on the advisory, the defect lies in how the Web Service API validates authenticated requests, allowing a low-privileged user to invoke operations that should require higher authorization. The scope change indicates the API operates with privileges that extend beyond its own trust boundary.
Attack Vector
The attack vector is network-based over HTTP. The attacker requires a valid low-privileged account on the target instance. No user interaction is required. Attack complexity is low, and the exploitation path involves crafted requests to the Web Service API endpoints exposed by BI Publisher.
No public proof-of-concept has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert CPU July 2026 for vendor technical details.
Detection Methods for CVE-2026-60719
Indicators of Compromise
- Unexpected authenticated HTTP requests to /xmlpserver/services/* and other BI Publisher Web Service API endpoints from low-privileged accounts.
- Creation, modification, or deletion of BI Publisher reports, data sources, or scheduled jobs outside of change windows.
- Outbound connections from the BI Publisher host to previously unseen destinations following API calls.
Detection Strategies
- Enable audit logging on Oracle BI Publisher and correlate Web Service API activity with the invoking account role.
- Alert on low-privileged accounts issuing API calls that touch report definitions, data models, or data source configurations.
- Baseline normal Web Service API traffic and flag deviations in request volume, method mix, and response codes.
Monitoring Recommendations
- Forward BI Publisher access logs, application server logs, and WebLogic audit events to a centralized SIEM.
- Monitor for privilege boundary crossings where a low-role account triggers actions affecting shared analytics resources.
- Track host-level indicators such as new processes, scheduled tasks, or file writes under the BI Publisher install directory.
How to Mitigate CVE-2026-60719
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to affected BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
- Inventory all Oracle Analytics deployments and confirm patch status against the Oracle advisory.
- Rotate credentials for BI Publisher service accounts and review recent audit logs for anomalous API usage.
Patch Information
Oracle released the fix as part of the Oracle Critical Patch Update July 2026. Administrators should follow the platform-specific patch bundle instructions and validate the fix in a staging environment before production rollout.
Workarounds
- Restrict network access to the BI Publisher Web Service API using firewall rules or a reverse proxy allowlist until patching completes.
- Reduce the number of low-privileged accounts with access to BI Publisher and enforce least privilege on remaining roles.
- Disable unused Web Service API endpoints if operational requirements permit.
# Example: restrict access to BI Publisher API via iptables
iptables -A INPUT -p tcp --dport 9502 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
