Listen to this Post
CVE-2026-60173 is a critical vulnerability affecting the Oracle BI Publisher product within Oracle Analytics. The flaw resides in the BI Platform Security component and impacts supported versions 8.2.0.0.0 and 12.2.1.4.0. The vulnerability is trivially exploitable over the network by an unauthenticated attacker requiring no user interaction or privileges, with a low attack complexity.
At its core, the issue stems from improper access control (CWE-284) within the authentication and authorization mechanisms of the BI Publisher platform. Specifically, the BI Platform Security component fails to adequately validate and enforce permissions on certain HTTP-accessible endpoints, allowing an external actor to bypass security checks entirely.
An attacker can send crafted HTTP requests to vulnerable BI Publisher endpoints—such as those under /xmlpserver/, /xdo/, or /bi/publisher/—which are normally restricted to authenticated administrative users. Due to the access control bypass, the server processes these requests with elevated privileges, effectively treating the unauthenticated attacker as an authorized administrator.
Once the attacker gains this level of access, they can perform arbitrary actions within the BI Publisher environment. This includes reading sensitive reports and data repositories (confidentiality breach), modifying or deleting existing reports and configurations (integrity violation), and disrupting the availability of the BI Publisher service. In the worst case, the attacker can achieve complete takeover of the Oracle BI Publisher instance, potentially using it as a pivot point to access broader enterprise systems.
The CVSS 3.1 base score is 9.8, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the full impact on confidentiality, integrity, and availability. The vulnerability is automatable, meaning it can be exploited by automated tools without human intervention, and the technical impact is total. As of the publication date, there is no evidence of active exploitation in the wild, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. However, given the ease of exploitation and the critical nature of BI Publisher in many organizations, this vulnerability poses a severe risk—especially for internet-facing deployments.
Oracle has addressed this issue in the July 2026 Critical Patch Update (CPU). Administrators are strongly urged to apply the vendor-supplied patches immediately or, if patching is not immediately possible, to restrict HTTP access to trusted networks and monitor for suspicious activity.
DailyCVE Form:
Platform: Oracle BI Publisher
Version: 8.2.0.0.0, 12.2.1.4.0
Vulnerability: Improper Access Control (CWE-284)
Severity: Critical (CVSS 9.8)
Date: 2026-07-21
Prediction: 2026-08-04
Analytics under What Undercode Say:
Detect Oracle BI Publisher version via HTTP headers or response patterns
curl -s -I http://target/xmlpserver/ | grep -i "server"
Check for vulnerable endpoints (unauthenticated access attempt)
curl -s -o /dev/null -w "%{http_code}" http://target/xmlpserver/services/v2/ReportService
Inventory BI Publisher instances across the network
nmap -p 80,443 --open -sV --script http- -T4 192.168.1.0/24 | grep -i "oracle bi publisher"
Query Oracle patch level (requires authenticated access to Weblogic console)
Example: list installed patches via OPatch
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i "bi publisher"
Monitor for suspicious POST requests to sensitive endpoints
grep -E "POST./(xmlpserver|xdo|bi/publisher)/" /var/log/httpd/access_log | awk '{print $1, $7, $9}'
Check for CVE-2026-60173 indicators in application logs
tail -f /opt/oracle/bi/logs/core/.log | grep -E "unauthorized|access denied|bypass"
Exploit:
The vulnerability is exploited by sending unauthenticated HTTP POST requests to privileged BI Publisher API endpoints, such as the ReportService or AdminService endpoints under /xmlpserver/services/. The crafted request mimics an administrative session, bypassing the access control checks due to the improper validation of security tokens. Successful exploitation allows the attacker to execute administrative functions—including report generation, data export, user management, and system configuration changes—without any credentials. Public proof-of-concept code is not yet available, but the vulnerability is considered automatable, and attackers are likely to develop exploits rapidly.
Protection:
- Apply Oracle’s July 2026 Critical Patch Update (CPU) immediately. The patch is available via Oracle Support and addresses the access control flaw in BI Platform Security.
- If patching is delayed, restrict all HTTP and HTTPS access to BI Publisher endpoints to trusted internal networks using firewalls or network access control lists (ACLs).
- Deploy a Web Application Firewall (WAF) with rules to block unauthorized access to
/xmlpserver/,/xdo/, and `/bi/publisher/` paths from untrusted sources. - Enforce identity-aware proxy solutions (e.g., Azure Application Proxy, Zscaler, Cloudflare Access) to add an additional authentication layer before traffic reaches BI Publisher.
- Disable or remove public DNS records for BI Publisher instances to reduce attack surface.
- Monitor access logs for anomalous patterns, such as repeated POST requests to administrative endpoints from external IP addresses.
Impact:
Successful exploitation results in complete takeover of the Oracle BI Publisher instance. An attacker can read all reports and underlying data (confidentiality compromise), modify or delete reports and configurations (integrity breach), and cause service outages (availability loss). The vulnerability is rated CVSS 9.8 (Critical), indicating the highest level of risk. Organizations using affected versions with BI Publisher exposed to the internet face imminent threat of data exfiltration, business disruption, and potential lateral movement into connected enterprise systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
