CVE-2026-91518: Oracle BI Publisher Auth Bypass Flaw

CVE-2026-91518 Overview

CVE-2026-91518 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically within the BI Publisher Security component. The flaw allows a low-privileged attacker with network access over HTTP to compromise Oracle BI Publisher. Successful exploitation can result in unauthorized update, insert, or delete access to a subset of accessible data, as well as unauthorized read access to a subset of BI Publisher data. Oracle disclosed the issue as part of the October 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can modify and read a subset of Oracle BI Publisher data without user interaction, affecting both confidentiality and integrity.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-10-20 - CVE CVE-2026-91518 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in the NVD database

Technical Details for CVE-2026-91518

Vulnerability Analysis

The vulnerability resides in the BI Publisher Security component of Oracle BI Publisher. An authenticated attacker holding low privileges can send crafted HTTP requests to the affected service and bypass expected access control constraints. The resulting access permits partial data modification (update, insert, delete) and partial data read against resources the attacker should not be able to touch.

The issue is categorized as an access control weakness. The attack is network-exposed, requires no user interaction, and does not break out of the vulnerable component's security scope. Availability of the service is not impacted, but both confidentiality and integrity are affected at a limited scope.

Oracle has not published root-cause internals, and no public proof-of-concept exploit is currently available. The EPSS score at publication is 0.183%, placing the vulnerability in a low predicted-exploitation band.

Root Cause

Oracle's advisory attributes the issue to the BI Publisher Security component. The specific weakness class has not been published in the vendor advisory, but the described impact pattern — authenticated low-privilege access leading to partial read and write across data boundaries — is consistent with broken access control. No CWE identifier has been assigned in the NVD record.

Attack Vector

Exploitation requires network access via HTTP and valid low-privilege credentials on the BI Publisher instance. The attacker interacts with the application over its standard web interface. No social engineering or user interaction is required. Internet-exposed BI Publisher deployments carry elevated risk, as do multi-tenant environments where low-privileged accounts are broadly provisioned.

No verified exploitation code is publicly available. See the Oracle Security Alert - October 2026 for authoritative technical references.

Detection Methods for CVE-2026-91518

Indicators of Compromise

Unexpected HTTP requests to Oracle BI Publisher endpoints originating from accounts with minimal assigned roles.
Audit log entries showing update, insert, or delete operations by users who should not have write access to the affected data objects.
Anomalous read operations against BI Publisher reports or data models by low-privileged accounts.

Detection Strategies

Review Oracle BI Publisher audit logs for write operations initiated by non-administrative principals.
Compare role-to-action mappings against expected baselines and flag deviations.
Correlate authentication events with subsequent data modification activity for low-privileged users.

Monitoring Recommendations

Enable verbose auditing on BI Publisher Security component actions and ship logs to a centralized SIEM.
Alert on bursts of HTTP requests from a single authenticated session targeting multiple report or data model objects.
Monitor outbound data volume from BI Publisher servers to detect bulk read activity.

How to Mitigate CVE-2026-91518

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to all affected BI Publisher instances (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0).
Inventory and revoke unnecessary low-privilege accounts on BI Publisher, especially on internet-reachable deployments.
Rotate credentials for any accounts suspected of misuse during the exposure window.

Patch Information

Oracle addressed CVE-2026-91518 in the October 2026 Critical Patch Update. Refer to the Oracle Security Alert - October 2026 for the specific patch bundles, prerequisite patches, and installation instructions covering supported BI Publisher versions.

Workarounds

Restrict network access to BI Publisher to trusted management networks and VPN segments until patching is complete.
Place BI Publisher behind a web application firewall (WAF) with rules limiting authenticated requests to expected endpoints.
Enforce least-privilege role assignments and remove write permissions from accounts that only require read access.

bash

# Example: restrict BI Publisher access at the network edge (iptables)
iptables -A INPUT -p tcp --dport 9502 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP