CVE-2026-91554: Oracle BI Publisher Auth Bypass Vulnerability

CVE-2026-91554 Overview

CVE-2026-91554 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically within the Web Server component. The affected supported version is 12.2.1.4.0. An unauthenticated attacker with network access via Hypertext Transfer Protocol (HTTP) can exploit this flaw without user interaction.

Successful exploitation allows attackers to perform unauthorized update, insert, or delete operations against a subset of Oracle BI Publisher accessible data. Attackers also gain unauthorized read access to a limited scope of data. The flaw affects both confidentiality and integrity, with no direct impact on availability.

Critical Impact
Unauthenticated network attackers can modify and read a subset of Oracle BI Publisher data via HTTP, with low attack complexity and no user interaction required.

Affected Products

Oracle BI Publisher (Oracle Analytics)
Component: Web Server
Supported version affected: 12.2.1.4.0

Discovery Timeline

2026-10-20 - CVE-2026-91554 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Security Alert - October 2026

Technical Details for CVE-2026-91554

Vulnerability Analysis

The vulnerability resides in the Web Server component of Oracle BI Publisher 12.2.1.4.0. Oracle BI Publisher is an enterprise reporting solution used to author, manage, and deliver reports across business applications. A flaw in the HTTP-facing Web Server component permits unauthenticated requests to reach functionality that performs data operations.

The issue requires no privileges and no user interaction. Oracle classifies the attack as easily exploitable over the network. Impact is scoped to confidentiality and integrity of a subset of accessible data within the BI Publisher instance. Availability is not affected by this vulnerability.

Because BI Publisher often holds sensitive operational and financial reporting data, even partial read and write access carries meaningful business risk. Enterprises exposing BI Publisher to broader network segments face the highest exposure.

Root Cause

Oracle has not published root cause details in the public advisory. The vulnerability resides in request handling within the Web Server component, enabling data access and modification without proper authentication. See the Oracle Security Alert - October 2026 for vendor-controlled details.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted HTTP requests to the BI Publisher Web Server component. No credentials or user interaction are required to trigger the condition. Successful requests result in unauthorized read, insert, update, or delete operations against a subset of BI Publisher data.

No verified public proof-of-concept code is available at this time. The Exploit Prediction Scoring System (EPSS) probability is approximately 0.205% with a percentile of 9.92, indicating low near-term exploitation likelihood based on current signals.

Detection Methods for CVE-2026-91554

Indicators of Compromise

Unexpected HTTP requests to BI Publisher Web Server endpoints originating from untrusted sources or at unusual times.
Unauthorized changes to BI Publisher report definitions, data models, or scheduled jobs without a corresponding administrator session.
Database audit records showing insert, update, or delete operations initiated by the BI Publisher service account outside normal patterns.

Detection Strategies

Review BI Publisher and WebLogic access logs for anomalous HTTP methods, unusual URI patterns, or requests from unknown source addresses.
Correlate web server activity with downstream data modifications to surface unauthenticated changes.
Deploy signatures on web application firewalls (WAFs) to flag malformed or unauthenticated requests to BI Publisher endpoints.

Monitoring Recommendations

Enable verbose auditing on the BI Publisher Web Server and forward logs to a centralized analytics platform.
Monitor for integrity changes on report templates, data sources, and scheduler configurations.
Alert on new or unexpected outbound connections from BI Publisher hosts that may indicate post-exploitation activity.

How to Mitigate CVE-2026-91554

Immediate Actions Required

Apply the fixes documented in the Oracle Critical Patch Update for October 2026 to all Oracle BI Publisher 12.2.1.4.0 deployments.
Inventory all BI Publisher instances, including development and test environments, to confirm patch coverage.
Restrict network access to BI Publisher Web Server endpoints to trusted administrative networks only.

Patch Information

Oracle addressed this vulnerability in the October 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - October 2026 advisory for the specific patch bundle, prerequisites, and installation guidance applicable to BI Publisher 12.2.1.4.0.

Workarounds

Place BI Publisher behind a reverse proxy or WAF that enforces authentication and rate limits on HTTP requests.
Segment BI Publisher servers from untrusted networks and block inbound HTTP from the internet.
Rotate credentials and API keys used by BI Publisher if unauthorized data modification is suspected after review.

bash

# Example: restrict inbound HTTP access to BI Publisher using iptables
# Allow only the trusted admin subnet 10.10.20.0/24 to reach port 9502
iptables -A INPUT -p tcp --dport 9502 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP