CVE-2026-61305 Overview
CVE-2026-61305 is a high-severity access control weakness in the Oracle BI Publisher product of Oracle Analytics, specifically within the BI Platform Security component. The flaw affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. An authenticated attacker with low privileges and network access over HTTP can exploit the vulnerability to compromise Oracle BI Publisher. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, full read access to BI Publisher data, and a partial denial of service condition. The weakness is categorized under CWE-284: Improper Access Control.
Critical Impact
Authenticated attackers can gain complete read/write access to Oracle BI Publisher data and trigger partial service disruption over the network.
Affected Products
- Oracle BI Publisher 8.2.0.0.0
- Oracle BI Publisher 12.2.1.4.0
- Oracle BI Publisher 26.01.0.0.0
Discovery Timeline
- 2026-08-18 - CVE CVE-2026-61305 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-61305
Vulnerability Analysis
CVE-2026-61305 resides in the BI Platform Security component of Oracle BI Publisher, which enforces access controls over report objects, data models, and administrative functions. The vulnerability allows a low-privileged authenticated user to bypass authorization checks and reach functionality reserved for higher-privileged accounts.
Once access boundaries are broken, the attacker can read, modify, or delete any data accessible to the BI Publisher instance. The same code path also enables the attacker to consume resources or disrupt request handling, producing a partial denial of service. Because BI Publisher frequently connects to enterprise databases and warehouses, the confidentiality and integrity impacts extend to sensitive reporting datasets.
The EPSS model currently estimates a probability of 0.265% for exploitation within 30 days.
Root Cause
The root cause is improper access control [CWE-284] within BI Platform Security. Authorization checks fail to sufficiently validate the caller's role or entitlement before granting access to protected operations. An attacker who already possesses valid low-privileged credentials can invoke functionality intended for administrators.
Attack Vector
Exploitation is performed remotely over HTTP against a reachable BI Publisher instance. The attack requires authentication but no user interaction, and complexity is low. A single crafted HTTP request against an affected endpoint is sufficient to trigger the authorization failure and access protected resources.
No public proof-of-concept code is available. Refer to the Oracle Security Alert August 2026 for vendor guidance.
Detection Methods for CVE-2026-61305
Indicators of Compromise
- Unexpected HTTP requests to Oracle BI Publisher administrative or data-model endpoints originating from low-privileged user sessions.
- Creation, modification, or deletion of report templates, data models, or scheduled jobs by accounts that historically never performed those actions.
- Anomalous spikes in report execution, data export volumes, or BI Publisher service errors.
Detection Strategies
- Enable and review BI Publisher audit logs for authorization decisions and administrative actions correlated to user identity.
- Baseline normal API and report activity per user role, then alert on deviations that indicate role escalation.
- Correlate web-tier HTTP access logs with WebLogic and BI Publisher audit events to identify unauthorized endpoint access.
Monitoring Recommendations
- Forward BI Publisher, WebLogic, and reverse proxy logs to a centralized SIEM for cross-source correlation.
- Monitor for outbound data transfers from BI Publisher hosts that exceed normal reporting volumes.
- Track failed and successful authentication attempts against BI Publisher, alerting on lateral use of low-privileged accounts.
How to Mitigate CVE-2026-61305
Immediate Actions Required
- Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert August 2026 to all affected BI Publisher instances.
- Inventory BI Publisher deployments and confirm which run versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0.
- Restrict network access to BI Publisher management interfaces to trusted administrative networks only.
- Audit user accounts and remove unused or over-privileged BI Publisher access.
Patch Information
Oracle addresses CVE-2026-61305 in the August 2026 Critical Patch Update. Administrators should download the appropriate patch bundle for their BI Publisher version from My Oracle Support and apply it following Oracle's documented patching procedures. See the Oracle Security Alert August 2026 for the complete patch matrix.
Workarounds
- Place BI Publisher behind a web application firewall configured to inspect and rate-limit requests to sensitive endpoints.
- Enforce network segmentation so that only authenticated internal users on trusted subnets can reach BI Publisher.
- Rotate credentials for low-privileged BI Publisher accounts and enable multi-factor authentication where supported.
- Disable or restrict BI Publisher features that are not required in your deployment to reduce the exposed attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
