CVE-2026-71057 Overview
CVE-2026-71057 is an access control vulnerability in the Oracle BI Publisher product within Oracle Analytics. The flaw resides in the BI Platform Security component and affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized access to critical data reachable through Oracle BI Publisher and can cause a partial denial of service. The scope change indicates that the impact extends beyond BI Publisher to additional integrated Oracle products. Oracle addressed the issue in the August 2026 Critical Patch Update.
Critical Impact
An authenticated attacker can access all data available through Oracle BI Publisher and disrupt service across dependent Oracle Analytics components.
Affected Products
- Oracle BI Publisher 8.2.0.0.0
- Oracle BI Publisher 12.2.1.4.0
- Oracle BI Publisher 26.1.0.0.0
Discovery Timeline
- 2026-08-18 - CVE-2026-71057 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-71057
Vulnerability Analysis
The vulnerability is classified as Improper Access Control [CWE-284] in the BI Platform Security component of Oracle BI Publisher. A low-privileged authenticated user can send crafted HTTP requests that bypass authorization checks enforced by the platform. The scope change property means the exploited component acts on resources managed by other integrated Oracle Analytics services. This allows the attacker to read data belonging to other tenants, reports, or datasources that the account should not access. The confidentiality impact is rated high while the availability impact is limited to partial denial of service of BI Publisher itself.
Root Cause
The root cause lies in insufficient enforcement of access control decisions within the BI Platform Security layer. Authorization boundaries between the BI Publisher service and adjacent Oracle Analytics components are not properly validated. Requests originating from a low-privileged session are trusted for downstream resource operations that should require higher privileges. This weakness aligns with [CWE-284] Improper Access Control.
Attack Vector
Exploitation requires network access to the BI Publisher HTTP interface and a valid low-privileged account. The attacker issues crafted HTTP requests against exposed BI Publisher endpoints that interact with the BI Platform Security module. Because the attack complexity is low and no user interaction is required, exploitation is straightforward once credentials are obtained. Credentials can be acquired through phishing, credential stuffing, or reuse of leaked passwords.
No verified public exploit code is available. The Exploit Prediction Scoring System (EPSS) rates near-term exploitation probability at 0.348%. See the Oracle Critical Patch Update Advisory - August 2026 for vendor technical details.
Detection Methods for CVE-2026-71057
Indicators of Compromise
- Unexpected HTTP requests from low-privileged BI Publisher accounts targeting administrative or cross-tenant report endpoints.
- Access log entries showing report or datasource retrieval by accounts without corresponding role assignments.
- Unusual spikes in xmlpserver requests followed by large data exports.
- Partial service degradation or timeouts in BI Publisher scheduling and rendering subsystems.
Detection Strategies
- Correlate BI Publisher application logs with identity provider logs to identify authorization decisions that do not match user role membership.
- Baseline normal report-access patterns per user and alert on deviations such as access to reports outside assigned folders.
- Monitor for HTTP 4xx to 2xx transitions on the same endpoint that may indicate authorization bypass attempts.
Monitoring Recommendations
- Enable verbose audit logging on the BI Platform Security component and forward logs to a central SIEM.
- Track authentication events on BI Publisher accounts, especially privilege changes and after-hours access.
- Alert on repeated access to sensitive data models by accounts that historically did not query them.
How to Mitigate CVE-2026-71057
Immediate Actions Required
- Apply the Oracle Critical Patch Update released in August 2026 to all affected BI Publisher instances.
- Inventory 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0 deployments and prioritize internet-exposed systems.
- Rotate credentials for BI Publisher service and administrator accounts.
- Review recent report access and export activity for signs of unauthorized data retrieval.
Patch Information
Oracle released fixes for CVE-2026-71057 as part of the August 2026 Critical Patch Update. Administrators should download and apply the patch documented in the Oracle Critical Patch Update Advisory - August 2026. Follow the Oracle-provided patch installation guide for each affected version and validate the patch level after deployment.
Workarounds
- Restrict network access to the BI Publisher HTTP interface using firewall rules or a reverse proxy allowlist until patching is complete.
- Remove or disable unused low-privileged BI Publisher accounts to reduce the exploitable attack surface.
- Enforce multi-factor authentication on all BI Publisher user accounts through the upstream identity provider.
- Segment BI Publisher servers from other Oracle Analytics components to limit the scope-change impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
