CVE-2026-71059: Oracle BI Publisher Privilege Escalation

CVE-2026-71059 Overview

CVE-2026-71059 is a critical vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically within the Web Service API component. Supported versions 8.2.0.0.0 and 26.1.0.0.0 are affected. A low-privileged attacker with network access via Simple Object Access Protocol (SOAP) can compromise Oracle BI Publisher. The flaw carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Successful attacks result in complete takeover of Oracle BI Publisher, with high impact to confidentiality, integrity, and availability. The weakness is categorized as improper access control [CWE-284].

Critical Impact
A low-privileged remote attacker can fully compromise Oracle BI Publisher through the SOAP Web Service API, with a scope change that propagates impact to additional Oracle products.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 26.1.0.0.0
Oracle Analytics (BI Publisher component)

Discovery Timeline

2026-08-18 - CVE-2026-71059 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71059

Vulnerability Analysis

The vulnerability resides in the Web Service API of Oracle BI Publisher. The component exposes SOAP endpoints that permit low-privileged authenticated users to invoke operations without adequate access control enforcement. Because the flaw introduces a scope change, exploitation compromises resources managed outside the vulnerable component's security authority. The result is full takeover of the BI Publisher instance and downstream impact to integrated Oracle Analytics products. The Exploit Prediction Scoring System (EPSS) probability is 0.286% (percentile 21.205) as of 2026-08-20.

Root Cause

The issue maps to [CWE-284: Improper Access Control]. The SOAP Web Service API does not correctly validate that the authenticated user has authorization to perform requested operations. Access decisions rely on insufficient checks, allowing low-privileged accounts to execute privileged actions. The scope change indicates that authorization boundaries between BI Publisher and adjacent Oracle Analytics components are not enforced.

Attack Vector

Exploitation requires network access to the BI Publisher SOAP endpoint and any valid low-privileged account. No user interaction is required. The attacker sends crafted SOAP requests to the Web Service API to invoke operations that should be restricted. Because attack complexity is low, a working exploit against one instance generalizes to other affected deployments. See the Oracle Security Alert for vendor technical details.

Detection Methods for CVE-2026-71059

Indicators of Compromise

Unexpected SOAP requests to Oracle BI Publisher Web Service API endpoints from low-privileged service accounts.
Creation of new administrative users, reports, or data sources within BI Publisher outside of change windows.
Outbound connections from the BI Publisher host to unfamiliar external systems immediately after SOAP traffic.
Modifications to scheduled jobs or report templates that execute arbitrary commands or queries.

Detection Strategies

Enable verbose logging on the BI Publisher Web Service API and alert on SOAP calls invoking privileged operations by non-administrative accounts.
Baseline normal SOAP request patterns to the /xmlpserver/services/ endpoints and flag deviations.
Correlate authentication events with subsequent API activity to detect privilege abuse.

Monitoring Recommendations

Forward BI Publisher application, WebLogic, and OS-level logs to a centralized analytics platform for retention and correlation.
Monitor the underlying application server for spawned child processes or file writes to report template directories.
Track outbound network egress from BI Publisher hosts to detect data exfiltration following compromise.

How to Mitigate CVE-2026-71059

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for August 2026 without delay.
Inventory all Oracle BI Publisher instances running 8.2.0.0.0 or 26.1.0.0.0 and prioritize internet-exposed systems.
Rotate credentials for BI Publisher service accounts and audit account privileges for least-privilege alignment.
Review Web Service API access logs for suspicious SOAP activity dating back to the patch release.

Patch Information

Oracle addressed CVE-2026-71059 in its August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the specific patch identifiers, downloads, and post-installation verification steps applicable to their BI Publisher version.

Workarounds

Restrict network access to the BI Publisher SOAP Web Service API using firewall or reverse-proxy allow-lists limited to trusted management hosts.
Disable unused SOAP endpoints on the BI Publisher server where operationally feasible.
Require multi-factor authentication (MFA) at the identity provider for all accounts able to reach BI Publisher.
Segment BI Publisher hosts from adjacent Oracle Analytics components to reduce blast radius from the scope change.

bash

# Example: restrict SOAP endpoint access at the reverse proxy (nginx)
location /xmlpserver/services/ {
    allow 10.20.30.0/24;   # trusted management subnet
    deny  all;
    proxy_pass http://bipublisher-backend;
}