PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60719 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:12.250Z and has not been modified since then. The vulnerability affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, with a CVSS score of 9.9, indicating critical severity. This critical vulnerability in Oracle BI Publisher's Web Service API allows low-privileged attackers with network access via HTTP to compromise Oracle BI Publisher, potentially impacting additional products. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, unauthorized access to critical data, and partial denial of service. Defenders should verify the existence of affected product deployments in managed environments and review official advisories for validation of affected scope, severity, and vendor guidance.

Vendor
Oracle Corporation
Product
Oracle BI Publisher
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-03
Advisory published
2026-07-21
Advisory updated
2026-08-03

Who should care

Organizations using Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 should prioritize patching to prevent potential data breaches and service disruptions. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their systems and data.

Technical summary

CVE-2026-60719 is a critical vulnerability in Oracle BI Publisher's Web Service API, allowing low-privileged attackers with network access via HTTP to compromise Oracle BI Publisher, potentially impacting additional products. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data, unauthorized access to critical data, and partial denial of service. The vulnerability has a CVSS score of 9.9, indicating critical severity, and affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Defensive priority

Oracle BI Publisher vulnerability allows low-privileged attackers to compromise data integrity, confidentiality, and availability; prioritize patching for critical data protection.

Recommended defensive actions

  • Apply patches for Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0
  • Restrict network access to Oracle BI Publisher
  • Monitor for unauthorized data access and modifications
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-60719 vulnerability affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, with a CVSS score of 9.9, indicating critical severity. This critical vulnerability in Oracle BI Publisher's Web Service API allows low-privileged attackers with network access via HTTP to compromise Oracle BI Publisher, potentially impacting additional products. The vulnerability has not been modified since its publication on 2026-07-21T22:18:12.250Z. Defenders should verify the existence of affected product deployments in managed environments and review official advisories for validation of affected scope, severity, and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:12.250Z and has not been modified since then.