CVE-2026-91555: Oracle BI Publisher Auth Bypass Flaw

CVE-2026-91555 Overview

CVE-2026-91555 is a medium-severity vulnerability in the Web Server component of Oracle BI Publisher, part of Oracle Analytics. The flaw affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. An unauthenticated attacker with network access over HTTP can exploit the issue, but successful attacks require user interaction from a victim other than the attacker. Exploitation can result in unauthorized read, insert, update, or delete access to a subset of BI Publisher data. Because the vulnerability causes a scope change, successful attacks may significantly impact additional products beyond BI Publisher itself.

Critical Impact

Remote attackers can trick authenticated users into triggering requests that compromise BI Publisher data integrity and confidentiality, with impact extending beyond the vulnerable component.

Affected Products

• Oracle BI Publisher 8.2.0.0.0
• Oracle BI Publisher 12.2.1.4.0
• Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

• 2026-10-20 - CVE-2026-91555 published to NVD as part of Oracle Critical Patch Update
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-91555

Vulnerability Analysis

The vulnerability resides in the Web Server component of Oracle BI Publisher, Oracle's enterprise reporting platform within Oracle Analytics. The attack vector is network-based over HTTP, and no authentication is required to initiate exploitation. However, a user must interact with attacker-supplied content for the attack chain to succeed. This pattern is consistent with client-side injection flaws such as Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF), where attacker payloads execute in the context of a legitimate authenticated session.

The scope change indicator signals that code or actions executed through the vulnerability can affect resources beyond the BI Publisher security authority. Impacts include limited confidentiality loss and limited integrity loss, with no direct availability impact.

Root Cause

Oracle has not published detailed root-cause information in the public advisory. The combination of required user interaction, unauthenticated network access, and scope change points to insufficient output encoding or missing anti-forgery controls in the Web Server component. These weaknesses allow attacker-controlled input to execute within a victim's authenticated browser session against BI Publisher.

Attack Vector

An attacker crafts a malicious HTTP request or link and delivers it to a user authenticated to Oracle BI Publisher. When the victim loads the attacker's content, the browser issues requests to the BI Publisher Web Server under the victim's identity. The attacker can then read a subset of accessible data and perform unauthorized create, update, or delete operations. Because the scope changes, actions may affect integrated Oracle Analytics components beyond BI Publisher itself.

No public proof-of-concept exploit is listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. See the Oracle Critical Patch Update Advisory for vendor technical references.

Detection Methods for CVE-2026-91555

Indicators of Compromise

• Unexpected HTTP POST, PUT, or DELETE requests to BI Publisher endpoints originating from off-site referrers or unusual user agents.
• BI Publisher audit log entries showing data modifications performed by users immediately after loading external links or email content.
• Anomalous outbound requests from browsers of BI Publisher users to attacker-controlled domains preceding BI Publisher activity.

Detection Strategies

• Inspect web server access logs for BI Publisher URLs invoked with suspicious Referer headers or without expected anti-CSRF tokens.
• Correlate authenticated BI Publisher session activity with external HTTP referrers to identify cross-origin request patterns.
• Review BI Publisher reports and data model modifications against change-management records to spot unauthorized edits.

Monitoring Recommendations

• Enable detailed HTTP request logging on the BI Publisher Web Server, including request method, path, source IP, and referrer.
• Forward BI Publisher application and web server logs to a centralized analytics platform for continuous correlation.
• Alert on bursts of state-changing operations originating from a single session shortly after new link navigation events.

How to Mitigate CVE-2026-91555

Immediate Actions Required

• Apply the October 2026 Oracle Critical Patch Update for BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
• Restrict BI Publisher Web Server exposure to trusted networks or require VPN access until patching completes.
• Instruct BI Publisher users to avoid clicking untrusted links or opening unsolicited attachments while authenticated to the application.

Patch Information

Oracle addressed CVE-2026-91555 in the October 2026 Critical Patch Update. Administrators should download and deploy the fixes referenced in the Oracle Critical Patch Update Advisory. Validate patch application against Oracle's documented post-patch verification steps before returning the system to production.

Workarounds

• Place BI Publisher behind a web application firewall configured to enforce strict Referer and Origin header validation.
• Enforce short session timeouts and require re-authentication for sensitive report modifications.
• Deploy browser isolation or Content Security Policy headers to reduce the impact of attacker-controlled web content on authenticated sessions.

# Example WAF rule concept to block cross-origin state-changing requests to BI Publisher
# (adapt to your WAF syntax and BI Publisher URL path)
SecRule REQUEST_METHOD "@rx ^(POST|PUT|DELETE)$" \
  "chain,deny,status:403,id:1026091555,msg:'CVE-2026-91555 cross-origin block'"
  SecRule REQUEST_URI "@beginsWith /xmlpserver/" \
    "chain"
    SecRule REQUEST_HEADERS:Origin "!@rx ^https?://(biprod\.internal\.example\.com)$"