CVE-2026-71058: Oracle BI Publisher Auth Bypass Vulnerability

CVE-2026-71058 Overview

CVE-2026-71058 is an access control vulnerability in the Oracle BI Publisher product of Oracle Analytics. The flaw resides in the Web Service API component and affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access over HTTP can exploit this vulnerability without user interaction. Successful exploitation results in complete takeover of Oracle BI Publisher, including full loss of confidentiality, integrity, and availability. The weakness maps to [CWE-284: Improper Access Control].

Critical Impact
Authenticated attackers can compromise Oracle BI Publisher over the network with low complexity, leading to full product takeover.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-08-18 - CVE-2026-71058 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71058

Vulnerability Analysis

CVE-2026-71058 affects the Web Service API component of Oracle BI Publisher, a widely deployed enterprise reporting engine within the Oracle Analytics product family. The vulnerability allows a low-privileged authenticated user to bypass intended access restrictions and perform actions that should be limited to higher-privileged roles.

Exploitation occurs entirely over HTTP and requires no user interaction. Because BI Publisher stores connection credentials, data model definitions, and templates that reach into backend databases, product takeover extends the blast radius to downstream data sources. Attackers gaining control can exfiltrate reports, tamper with scheduled jobs, and pivot to connected systems using stored credentials.

Root Cause

The issue is categorized as improper access control [CWE-284] within the Web Service API. Authorization checks on one or more service endpoints do not correctly enforce the privilege boundary between low-privileged users and administrative operations. This gap allows requests from any authenticated account to reach functions that should be restricted.

Attack Vector

The attack vector is remote over the network. An attacker authenticates with any low-privileged BI Publisher account and issues crafted HTTP requests to the Web Service API. No social engineering, elevated privileges, or local access is required. The Oracle advisory does not publicly disclose the specific vulnerable endpoints. Refer to the Oracle Critical Patch Update Advisory - August 2026 for authoritative technical details.

Detection Methods for CVE-2026-71058

Indicators of Compromise

Unexpected administrative or configuration changes in Oracle BI Publisher performed by non-administrative accounts.
Anomalous HTTP requests from authenticated low-privileged users to BI Publisher Web Service API endpoints.
New or modified data models, report templates, or scheduled jobs that reference untrusted external systems.
Outbound connections from the BI Publisher host to unfamiliar destinations following API activity.

Detection Strategies

Review BI Publisher audit logs for privilege escalation patterns, focusing on API calls that touch administrative functions from standard user accounts.
Correlate web server access logs with BI Publisher application logs to identify sessions issuing atypical Web Service API request sequences.
Baseline normal API usage per role and alert on deviations, particularly requests to configuration, data source, or user management endpoints.

Monitoring Recommendations

Forward BI Publisher application logs, WebLogic access logs, and database audit trails to a centralized analytics platform for correlation.
Monitor authentication events on BI Publisher for brute force or credential stuffing that could seed exploitation with a low-privileged account.
Alert on outbound network flows from the BI Publisher server to non-approved destinations after API activity spikes.

How to Mitigate CVE-2026-71058

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update - August 2026 to all affected Oracle BI Publisher instances.
Inventory every BI Publisher deployment across environments, including development and staging, and confirm version levels against 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
Rotate credentials stored in BI Publisher data sources if compromise is suspected, since product takeover exposes them.
Restrict network reachability to BI Publisher Web Service API endpoints to trusted segments and management jump hosts.

Patch Information

Oracle addressed CVE-2026-71058 in the August 2026 Critical Patch Update. Administrators should download the patch bundle for the applicable BI Publisher release from My Oracle Support and follow Oracle's documented installation procedure. Post-patch, validate service health and re-run authorization tests on Web Service API endpoints to confirm the fix.

Workarounds

Place BI Publisher behind a reverse proxy or web application firewall that enforces access control on Web Service API paths and rate-limits authenticated sessions.
Reduce the number of low-privileged accounts with BI Publisher access and enforce strong authentication and session controls until patching completes.
Disable or block Web Service API endpoints that are not required by production workflows to shrink the attack surface.

bash

# Example: restrict access to BI Publisher Web Service API at the reverse proxy
# Only allow requests from trusted management CIDR ranges
location /xmlpserver/services/ {
    allow 10.10.20.0/24;
    deny  all;
    proxy_pass http://bipublisher-backend;
}