CVE-2026-91526: Oracle BI Publisher Auth Bypass Vulnerability

CVE-2026-91526 Overview

CVE-2026-91526 affects the Web Server component of Oracle BI Publisher within Oracle Analytics. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful exploitation requires user interaction from a victim other than the attacker. The flaw produces a scope change, meaning attacks may impact products beyond Oracle BI Publisher itself. Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle BI Publisher data, as well as unauthorized read access to a subset of accessible data. Affected supported versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Critical Impact

Unauthenticated attackers can tamper with Oracle BI Publisher data and read a subset of it through HTTP requests that require victim interaction, with impact extending beyond Oracle BI Publisher due to scope change.

Affected Products

• Oracle BI Publisher 8.2.0.0.0
• Oracle BI Publisher 12.2.1.4.0
• Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

• 2026-10-20 - CVE-2026-91526 published to the National Vulnerability Database (NVD)
• 2026-10-21 - Last updated in NVD database
• October 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-91526

Vulnerability Analysis

The vulnerability resides in the Web Server component of Oracle BI Publisher, the enterprise reporting engine shipped with Oracle Analytics. Oracle classifies the issue as difficult to exploit but reachable over the network without authentication. Exploitation hinges on tricking a legitimate user into interacting with attacker-controlled content, such as following a crafted link or loading a malicious page while authenticated to the application.

Because the vulnerability triggers a scope change, the compromised Web Server component can influence resources beyond the trust boundary of Oracle BI Publisher. Impact is limited to confidentiality and integrity, with no availability impact. Attackers can read a subset of accessible data and perform unauthorized update, insert, or delete operations against some data accessible to BI Publisher.

Root Cause

Oracle has not published implementation-level details for CVE-2026-91526. The attack preconditions, including network reach via HTTP, required user interaction, and scope change, are consistent with a client-side injection or request-forgery class flaw in the Web Server component. See the Oracle Security Alert October 2026 for the authoritative advisory.

Attack Vector

An unauthenticated attacker delivers a crafted HTTP payload or link that targets an authenticated Oracle BI Publisher user. When the victim interacts with the content, the Web Server component processes the request in the victim's context. The attacker then gains limited read access to BI Publisher data and the ability to modify, insert, or delete subsets of data, with effects that can cross into other products.

No verified proof-of-concept code is available for this vulnerability. Refer to the Oracle advisory for upgrade and patch details.

Detection Methods for CVE-2026-91526

Indicators of Compromise

• Unexpected HTTP requests to Oracle BI Publisher Web Server endpoints originating from external referrers or embedded in third-party pages.
• Unauthorized create, update, or delete operations in BI Publisher data stores that cannot be correlated with legitimate user activity.
• Access log entries showing authenticated BI Publisher sessions performing actions immediately after loading external links.

Detection Strategies

• Review web server access logs for anomalous POST, PUT, or DELETE operations against Oracle BI Publisher endpoints tied to short-lived or externally referred sessions.
• Correlate authentication events with data-modification events in BI Publisher to surface state changes initiated outside of normal workflows.
• Monitor outbound email, chat, and web gateways for links pointing to Oracle BI Publisher URLs with unusual query parameters.

Monitoring Recommendations

• Centralize Oracle BI Publisher Web Server and application logs in a SIEM for retention and correlation with identity activity.
• Alert on repeated 4xx or 5xx responses from BI Publisher endpoints that precede successful authenticated writes.
• Baseline normal reporting workflow activity and flag deviations that coincide with user-interaction events such as link clicks or redirects.

How to Mitigate CVE-2026-91526

Immediate Actions Required

• Apply the fixes delivered in the Oracle Critical Patch Update for October 2026 to all affected Oracle BI Publisher deployments.
• Inventory Oracle BI Publisher instances running versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 and prioritize patching of internet-exposed systems.
• Advise BI Publisher users to avoid clicking untrusted links while authenticated to the application until patching is complete.

Patch Information

Oracle addressed CVE-2026-91526 in the October 2026 Critical Patch Update. Review the Oracle Security Alert October 2026 for the full patch matrix, including applicable fixes for versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Workarounds

• Restrict network access to Oracle BI Publisher Web Server endpoints to trusted internal networks or VPN users where feasible.
• Deploy a web application firewall policy that inspects requests to BI Publisher URLs and blocks suspicious cross-origin or forged request patterns.
• Enforce short session timeouts and require re-authentication for sensitive BI Publisher operations until patches are deployed.