CVE-2026-71058: Oracle BI Publisher Auth Bypass Flaw

CVE-2026-71058 Overview

CVE-2026-71058 is a high-severity access control weakness [CWE-284] in the Web Service API component of Oracle BI Publisher, part of Oracle Analytics. An authenticated attacker with low privileges can send crafted HTTP requests over the network to compromise the product. Successful exploitation results in full takeover of Oracle BI Publisher, impacting confidentiality, integrity, and availability. The affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Oracle disclosed the issue in its August 2026 Critical Patch Update Advisory.

Critical Impact
A low-privileged network attacker can take over Oracle BI Publisher through the Web Service API, gaining full read, write, and disruption capabilities against reporting infrastructure and downstream data sources.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-08-18 - CVE-2026-71058 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71058

Vulnerability Analysis

CVE-2026-71058 resides in the Web Service API of Oracle BI Publisher. The component fails to enforce proper access control [CWE-284] on requests submitted by authenticated users. An attacker with a low-privileged account can invoke functionality or reach resources that should be restricted to administrative roles. This class of flaw typically allows an attacker to abuse report definitions, data sources, or scheduler functions to execute privileged operations. Because Oracle BI Publisher commonly holds credentials to backend databases and enterprise data warehouses, takeover of the product frequently cascades into broader data exposure.

Root Cause

The root cause is improper access control on Web Service API endpoints. The service authenticates the caller but does not adequately verify authorization for the requested operation. Any account with network HTTP access and valid credentials, regardless of role, can reach code paths that should be gated by administrative privileges.

Attack Vector

Exploitation requires network access to the BI Publisher HTTP interface and a valid low-privileged account. No user interaction is required. The attacker sends specifically formed requests to the Web Service API to invoke restricted functionality. Refer to the Oracle Security Alert for vendor guidance and patch references. Public proof-of-concept code was not available at the time of publication.

Detection Methods for CVE-2026-71058

Indicators of Compromise

Unexpected HTTP requests to Oracle BI Publisher Web Service API endpoints originating from non-administrative user sessions.
Creation or modification of report definitions, data sources, or scheduled jobs by accounts that do not normally perform administrative actions.
New outbound connections from the BI Publisher server to attacker-controlled hosts following API activity.
Anomalous access to backend data source credentials configured within BI Publisher.

Detection Strategies

Enable verbose audit logging on Oracle BI Publisher and forward events to a centralized SIEM for correlation.
Baseline Web Service API usage per account and alert on deviations from expected roles and endpoints.
Monitor Oracle Analytics server processes for spawning of shells or scripting interpreters following HTTP activity.

Monitoring Recommendations

Track authentication events for low-privileged BI Publisher accounts accessing administrative APIs.
Alert on modifications to configuration files, report templates, and JNDI data source definitions.
Review web server access logs for repeated requests to sensitive API paths and unusual user agents.

How to Mitigate CVE-2026-71058

Immediate Actions Required

Apply the fixes referenced in the Oracle August 2026 Critical Patch Update Advisory to all affected BI Publisher deployments.
Restrict network reachability of the Web Service API to trusted management networks using firewall or reverse proxy controls.
Rotate credentials for any low-privileged BI Publisher accounts and disable accounts that are no longer required.
Audit report definitions, data sources, and scheduled jobs for unauthorized changes.

Patch Information

Oracle addressed CVE-2026-71058 as part of its August 2026 Critical Patch Update. Administrators should download and apply the corresponding patch bundle for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Full remediation guidance is available in the Oracle Security Alert.

Workarounds

Place Oracle BI Publisher behind a reverse proxy that enforces IP allow-listing for Web Service API paths until patches can be applied.
Reduce the number of accounts with any level of BI Publisher access and audit role assignments for least privilege.
Disable unused Web Service API features or endpoints where supported by the deployment configuration.

bash

# Example: restrict access to BI Publisher Web Service API at the reverse proxy
# nginx snippet - allow only management subnet to reach the API
location /xmlpserver/services/ {
    allow 10.10.20.0/24;
    deny  all;
    proxy_pass http://bi_publisher_backend;
}