# Oracle BI Publisher vulnerabilities Source: https://junglewise.ai/threats/technologies/bi-publisher Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/bi-publisher.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Oracle BI Publisher: 0 in the last 7 days and 35 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91608, was published on 20 October 2026. 10 vulnerabilities in the last four weeks, down 52% on the four before (21). 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 35 - All time: 38 (5 critical, 0 exploited in the wild) ## About Oracle BI Publisher Business intelligence report generation and publishing tool for Oracle enterprise systems. ## Latest Oracle BI Publisher vulnerabilities - [CVE-2026-91608: Oracle BI Publisher unauthenticated data access via web server](https://junglewise.ai/threats/cve-2026-91608-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-91590: Oracle BI Publisher authorization bypass in Web Service API](https://junglewise.ai/threats/cve-2026-91590-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 5.4, published 20 Oct 2026) - [CVE-2026-91579: Oracle BI Publisher unauthenticated takeover via HTTP](https://junglewise.ai/threats/cve-2026-91579-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (high, CVSS 8.8, published 20 Oct 2026) - [CVE-2026-91574: Oracle BI Publisher unauthorized data access vulnerability](https://junglewise.ai/threats/cve-2026-91574-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91555: Oracle BI Publisher CSRF or open redirect in web server](https://junglewise.ai/threats/cve-2026-91555-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-91554: Oracle BI Publisher unauthenticated data access in Web Server](https://junglewise.ai/threats/cve-2026-91554-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91528: Oracle BI Publisher unauthorized data read in BI Platform Security](https://junglewise.ai/threats/cve-2026-91528-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 4.3, published 20 Oct 2026) - [CVE-2026-91526: Oracle BI Publisher CSRF or request forgery via web server](https://junglewise.ai/threats/cve-2026-91526-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 4.7, published 20 Oct 2026) - [CVE-2026-91518: Oracle BI Publisher unauthorized data access in Security component](https://junglewise.ai/threats/cve-2026-91518-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 5.4, published 20 Oct 2026) - [CVE-2026-91514: Oracle BI Publisher unauthorized data access in Web Server](https://junglewise.ai/threats/cve-2026-91514-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-83320: Oracle BI Publisher cross-site scripting in Administration](https://junglewise.ai/threats/cve-2026-83320-oracle-bi-publisher-cross-site-scripting-in-administration) (high, CVSS 7.6, published 15 Sep 2026) - [CVE-2026-83319: Oracle BI Publisher unauthorized data access in Web Service API](https://junglewise.ai/threats/cve-2026-83319-oracle-bi-publisher-unauthorized-data-access-in-web-service-api) (high, CVSS 7.7, published 15 Sep 2026) - [CVE-2026-83318: Oracle BI Publisher privilege escalation in Administration](https://junglewise.ai/threats/cve-2026-83318-oracle-bi-publisher-privilege-escalation-in-administration) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-83315: Oracle BI Publisher privilege escalation in SOAP interface](https://junglewise.ai/threats/cve-2026-83315-oracle-bi-publisher-privilege-escalation-in-soap-interface) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-83314: Oracle BI Publisher privilege escalation in Web Service API](https://junglewise.ai/threats/cve-2026-83314-oracle-bi-publisher-privilege-escalation-in-web-service-api) (high, CVSS 8.1, published 15 Sep 2026) - [CVE-2026-83313: Oracle BI Publisher authorization bypass in BI Platform Security](https://junglewise.ai/threats/cve-2026-83313-oracle-bi-publisher-authorization-bypass-in-bi-platform-security) (high, CVSS 7.7, published 15 Sep 2026) - [CVE-2026-83312: Oracle BI Publisher unauthorized data access in E-Business Suite](https://junglewise.ai/threats/cve-2026-83312-oracle-bi-publisher-unauthorized-data-access-in-e-business-suite) (high, CVSS 7.7, published 15 Sep 2026) - [CVE-2026-83311: Oracle BI Publisher privilege escalation in SOAP interface](https://junglewise.ai/threats/cve-2026-83311-oracle-bi-publisher-privilege-escalation-in-soap-interface) (high, CVSS 8.5, published 15 Sep 2026) - [CVE-2026-83310: Oracle BI Publisher authorization bypass in BI Platform Security](https://junglewise.ai/threats/cve-2026-83310-oracle-bi-publisher-authorization-bypass-in-bi-platform-security) (high, CVSS 8.7, published 15 Sep 2026) - [CVE-2026-83309: Oracle BI Publisher privilege escalation in Web Server](https://junglewise.ai/threats/cve-2026-83309-oracle-bi-publisher-privilege-escalation-in-web-server) (high, CVSS 8.5, published 15 Sep 2026) - [CVE-2026-83308: Oracle BI Publisher authentication bypass in SOAP interface](https://junglewise.ai/threats/cve-2026-83308-oracle-bi-publisher-authentication-bypass-in-soap-interface) (high, CVSS 8.1, published 15 Sep 2026) - [CVE-2026-83307: Oracle BI Publisher privilege escalation in BI Platform Security](https://junglewise.ai/threats/cve-2026-83307-oracle-bi-publisher-privilege-escalation-in-bi-platform-security) (high, CVSS 8.3, published 15 Sep 2026) - [CVE-2026-83305: Oracle BI Publisher authentication bypass in BI Platform Security](https://junglewise.ai/threats/cve-2026-83305-oracle-bi-publisher-authentication-bypass-in-bi-platform-security) (high, CVSS 8.6, published 15 Sep 2026) - [CVE-2026-83303: Oracle BI Publisher privilege escalation in SOAP service](https://junglewise.ai/threats/cve-2026-83303-oracle-bi-publisher-privilege-escalation-in-soap-service) (high, CVSS 8.5, published 15 Sep 2026) - [CVE-2026-83302: Oracle BI Publisher authentication bypass in security component](https://junglewise.ai/threats/cve-2026-83302-oracle-bi-publisher-authentication-bypass-in-security-component) (high, CVSS 8.5, published 15 Sep 2026) ## Most severe Oracle BI Publisher vulnerabilities - [CVE-2026-71059: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions…](https://junglewise.ai/threats/cve-2026-71059-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-60719: Oracle BI Publisher unauthorized data access in Web Service API](https://junglewise.ai/threats/cve-2026-60719-oracle-bi-publisher-unauthorized-data-access-in-web-service-api) (critical, CVSS 9.9, published 21 Jul 2026) - [CVE-2026-83269: Oracle BI Publisher unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-83269-oracle-bi-publisher-unauthenticated-remote-code-execution) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-60173: Oracle BI Publisher remote compromise in BI Platform Security](https://junglewise.ai/threats/cve-2026-60173-oracle-bi-publisher-remote-compromise-in-bi-platform-security) (critical, CVSS 9.8, published 21 Jul 2026) - [CVE-2026-83268: Oracle BI Publisher privilege escalation in BI Platform Security](https://junglewise.ai/threats/cve-2026-83268-oracle-bi-publisher-privilege-escalation-in-bi-platform-security) (critical, CVSS 9.1, published 15 Sep 2026) - [CVE-2026-71058: Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions…](https://junglewise.ai/threats/cve-2026-71058-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (high, CVSS 8.8, published 18 Aug 2026) - [CVE-2026-83315: Oracle BI Publisher privilege escalation in SOAP interface](https://junglewise.ai/threats/cve-2026-83315-oracle-bi-publisher-privilege-escalation-in-soap-interface) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-91579: Oracle BI Publisher unauthenticated takeover via HTTP](https://junglewise.ai/threats/cve-2026-91579-vulnerability-in-the-oracle-bi-publisher-product-of-oracle) (high, CVSS 8.8, published 20 Oct 2026) - [CVE-2026-83310: Oracle BI Publisher authorization bypass in BI Platform Security](https://junglewise.ai/threats/cve-2026-83310-oracle-bi-publisher-authorization-bypass-in-bi-platform-security) (high, CVSS 8.7, published 15 Sep 2026) - [CVE-2026-83305: Oracle BI Publisher authentication bypass in BI Platform Security](https://junglewise.ai/threats/cve-2026-83305-oracle-bi-publisher-authentication-bypass-in-bi-platform-security) (high, CVSS 8.6, published 15 Sep 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, down 52% on the four before (21). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 4 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 21 | 2 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 10 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Oracle technologies - [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server): 163 vulnerabilities - [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management): 142 vulnerabilities - [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon): 130 vulnerabilities - [Oracle MySQL Cluster](https://junglewise.ai/threats/technologies/mysql-cluster): 129 vulnerabilities - [Oracle Coherence](https://junglewise.ai/threats/technologies/coherence): 113 vulnerabilities - [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite): 110 vulnerabilities - [Oracle WebCenter Content](https://junglewise.ai/threats/technologies/webcenter-content): 110 vulnerabilities - [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search): 104 vulnerabilities - [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager): 102 vulnerabilities - [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools): 101 vulnerabilities - [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools): 101 vulnerabilities - [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se): 92 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Oracle BI Publisher vulnerabilities", https://junglewise.ai/threats/technologies/bi-publisher, 9 November 2026.