Technology · Oracle
Oracle BI Publisher vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 38 vulnerabilities in Oracle BI Publisher: 0 in the last 7 days and 35 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91608, was published on 20 October 2026. 10 vulnerabilities in the last four weeks, down 52% on the four before (21). 0 critical against 2.
- Last 7 days
- 0
- Last 90 days
- 35
- Critical, all time
- 5
- Exploited in the wild
- 0
About Oracle BI Publisher
Business intelligence report generation and publishing tool for Oracle enterprise systems.
Latest Oracle BI Publisher vulnerabilities
- CVE-2026-91608: Oracle BI Publisher unauthenticated data access via web serverhighCVSS 7.5
- CVE-2026-91590: Oracle BI Publisher authorization bypass in Web Service APImediumCVSS 5.4
- CVE-2026-91579: Oracle BI Publisher unauthenticated takeover via HTTPhighCVSS 8.8
- CVE-2026-91574: Oracle BI Publisher unauthorized data access vulnerabilitymediumCVSS 6.5
- CVE-2026-91555: Oracle BI Publisher CSRF or open redirect in web servermediumCVSS 6.1
- CVE-2026-91554: Oracle BI Publisher unauthenticated data access in Web ServermediumCVSS 6.5
- CVE-2026-91528: Oracle BI Publisher unauthorized data read in BI Platform SecuritymediumCVSS 4.3
- CVE-2026-91526: Oracle BI Publisher CSRF or request forgery via web servermediumCVSS 4.7
- CVE-2026-91518: Oracle BI Publisher unauthorized data access in Security componentmediumCVSS 5.4
- CVE-2026-91514: Oracle BI Publisher unauthorized data access in Web ServermediumCVSS 6.5
- CVE-2026-83320: Oracle BI Publisher cross-site scripting in AdministrationhighCVSS 7.6EPSS 0.3%
- CVE-2026-83319: Oracle BI Publisher unauthorized data access in Web Service APIhighCVSS 7.7EPSS 0.3%
- CVE-2026-83318: Oracle BI Publisher privilege escalation in AdministrationhighCVSS 7.5EPSS 0.3%
- CVE-2026-83315: Oracle BI Publisher privilege escalation in SOAP interfacehighCVSS 8.8EPSS 0.4%
- CVE-2026-83314: Oracle BI Publisher privilege escalation in Web Service APIhighCVSS 8.1EPSS 0.4%
- CVE-2026-83313: Oracle BI Publisher authorization bypass in BI Platform SecurityhighCVSS 7.7EPSS 0.3%
- CVE-2026-83312: Oracle BI Publisher unauthorized data access in E-Business SuitehighCVSS 7.7EPSS 0.3%
- CVE-2026-83311: Oracle BI Publisher privilege escalation in SOAP interfacehighCVSS 8.5EPSS 0.3%
- CVE-2026-83310: Oracle BI Publisher authorization bypass in BI Platform SecurityhighCVSS 8.7EPSS 0.3%
- CVE-2026-83309: Oracle BI Publisher privilege escalation in Web ServerhighCVSS 8.5EPSS 0.3%
- CVE-2026-83308: Oracle BI Publisher authentication bypass in SOAP interfacehighCVSS 8.1EPSS 0.4%
- CVE-2026-83307: Oracle BI Publisher privilege escalation in BI Platform SecurityhighCVSS 8.3EPSS 0.4%
- CVE-2026-83305: Oracle BI Publisher authentication bypass in BI Platform SecurityhighCVSS 8.6EPSS 0.4%
- CVE-2026-83303: Oracle BI Publisher privilege escalation in SOAP servicehighCVSS 8.5EPSS 0.3%
- CVE-2026-83302: Oracle BI Publisher authentication bypass in security componenthighCVSS 8.5EPSS 0.4%
Most severe Oracle BI Publisher vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-71059: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions…criticalCVSS 9.9EPSS 0.4%
- CVE-2026-60719: Oracle BI Publisher unauthorized data access in Web Service APIcriticalCVSS 9.9
- CVE-2026-83269: Oracle BI Publisher unauthenticated remote code executioncriticalCVSS 9.8EPSS 0.5%
- CVE-2026-60173: Oracle BI Publisher remote compromise in BI Platform SecuritycriticalCVSS 9.8
- CVE-2026-83268: Oracle BI Publisher privilege escalation in BI Platform SecuritycriticalCVSS 9.1EPSS 0.5%
- CVE-2026-71058: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions…highCVSS 8.8EPSS 0.4%
- CVE-2026-83315: Oracle BI Publisher privilege escalation in SOAP interfacehighCVSS 8.8EPSS 0.4%
- CVE-2026-91579: Oracle BI Publisher unauthenticated takeover via HTTPhighCVSS 8.8
- CVE-2026-83310: Oracle BI Publisher authorization bypass in BI Platform SecurityhighCVSS 8.7EPSS 0.3%
- CVE-2026-83305: Oracle BI Publisher authentication bypass in BI Platform SecurityhighCVSS 8.6EPSS 0.4%
Vulnerabilities per week
10 vulnerabilities in the last four weeks, down 52% on the four before (21). 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 4 | 1 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 21 | 2 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 10 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle BI Publisher vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/bi-publisher)<a href="https://junglewise.ai/threats/technologies/bi-publisher"><img src="https://junglewise.ai/threats/technologies/bi-publisher/badge.svg" alt="Oracle BI Publisher vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/bi-publisher.json, and this page as text at https://junglewise.ai/threats/technologies/bi-publisher.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle BI Publisher vulnerabilities", https://junglewise.ai/threats/technologies/bi-publisher, 9 November 2026.