CVE-2026-91579: Oracle BI Publisher Auth Bypass Vulnerability

CVE-2026-91579 Overview

CVE-2026-91579 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically within the BI Platform Security component. An unauthenticated attacker with network access over HTTP can compromise Oracle BI Publisher when a user other than the attacker performs a required interaction. Successful exploitation results in full takeover of the Oracle BI Publisher instance, affecting confidentiality, integrity, and availability. Oracle disclosed the issue in the October 2026 Critical Patch Update. Affected supported versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Critical Impact

Successful exploitation allows an unauthenticated remote attacker to take over Oracle BI Publisher after tricking a legitimate user into a single interaction.

Affected Products

• Oracle BI Publisher 8.2.0.0.0
• Oracle BI Publisher 12.2.1.4.0
• Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

• 2026-10-20 - CVE-2026-91579 published to NVD
• 2026-10-21 - Last updated in NVD database
• October 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-91579

Vulnerability Analysis

The vulnerability resides in the BI Platform Security component of Oracle BI Publisher, part of Oracle Analytics. Oracle BI Publisher is an enterprise reporting platform used to author, manage, and deliver reports across business systems. A remote attacker can reach the vulnerable code path over HTTP without authentication. Exploitation requires human interaction from a user who is not the attacker, which aligns with classic client-assisted attack patterns such as a victim visiting a crafted URL or opening attacker-supplied content rendered by the server.

Oracle categorizes the outcome as a takeover of Oracle BI Publisher, impacting confidentiality, integrity, and availability. A compromised BI Publisher instance exposes report data, data source credentials, and scheduled jobs, and provides a pivot point into connected analytics and database tiers. Oracle has not published root-cause details in the public advisory beyond the component and interaction requirements.

Root Cause

Oracle has not disclosed the underlying weakness class in the public advisory, and no CWE identifier has been assigned. The documented behavior — unauthenticated network reachability, required user interaction, and full compromise of the application — is consistent with input-handling flaws in a user-facing BI Platform Security interface. Consult the Oracle Critical Patch Update advisory for authoritative fix details.

Attack Vector

The attack is network-based over HTTP and does not require prior authentication. The attacker must induce a non-attacker user to perform an action, such as clicking a crafted link or loading attacker-controlled content through BI Publisher. Once the interaction occurs, the attacker can take control of the BI Publisher instance.

No public proof-of-concept, exploit, or in-the-wild exploitation has been reported for CVE-2026-91579 at the time of writing. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91579

Indicators of Compromise

• Unexpected administrative or configuration changes within Oracle BI Publisher, including new users, data sources, or scheduled report jobs.
• Outbound HTTP or database connections from the BI Publisher host to unknown destinations following suspicious inbound requests.
• Anomalous process creation under the BI Publisher application server account, such as shell interpreters or scripting engines spawned by the Java process.

Detection Strategies

• Inspect BI Publisher and underlying WebLogic access logs for unauthenticated requests to BI Platform Security endpoints followed by authenticated user activity.
• Correlate web-tier requests that match crafted BI Publisher URLs with endpoint telemetry showing child processes or file writes by the application server.
• Alert on first-seen user agents, referrers, or request parameters targeting BI Publisher paths prior to patch deployment.

Monitoring Recommendations

• Enable verbose HTTP request logging on reverse proxies in front of BI Publisher and retain logs for retrospective hunting.
• Monitor the BI Publisher host for integrity changes to configuration files, report templates, and data source definitions.
• Baseline outbound network connections from the BI Publisher server and alert on deviations, particularly to new external hosts.

How to Mitigate CVE-2026-91579

Immediate Actions Required

• Apply the fixes delivered in the Oracle October 2026 Critical Patch Update to BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
• Restrict network exposure of Oracle BI Publisher to trusted internal networks and authenticated users via reverse proxy or WAF controls.
• Advise BI Publisher users to avoid clicking untrusted links referencing the BI Publisher host while patching is in progress.
• Rotate credentials for data sources, service accounts, and administrative users on any instance suspected of exposure.

Patch Information

Oracle addressed CVE-2026-91579 in the October 2026 Critical Patch Update. Review the Oracle Critical Patch Update advisory for the exact patch identifiers and installation guidance for each supported version. Oracle recommends applying Critical Patch Update fixes without delay, as the advisory notes that unpatched Oracle systems are a known target for attackers.

Workarounds

• Place Oracle BI Publisher behind an authenticating reverse proxy to block unauthenticated HTTP access to BI Platform Security endpoints.
• Enforce web filtering and email link protection to reduce the chance that users interact with attacker-crafted BI Publisher URLs.
• Segment the BI Publisher host from sensitive database and identity tiers until patches are validated and deployed.