CVE-2026-60673CWE-200information-disclosure

CVE-2026-60673

Medium · published July 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-22T02:18Z
Affected products (3)
ProductVersionsFixed in
oracle/bi_publisherall versions—
oracle/bi_publisherall versions—
oracle/bi_publisherall versions—
References (1)
https://www.oracle.com/security-alerts/cpujul2026.html · [email protected]
EPSS history
Timeline
  • 21 JUL 21:36Z
    Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services)
    cvelistv5