NCSC-2026-0259

Vulnerability from csaf_ncscnl - Published: 2026-07-22 15:22 - Updated: 2026-07-22 15:22
Summary
Kwetsbaarheden verholpen in Oracle Analytics
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft meerdere kwetsbaarheden verholpen in Oracle BI Publisher (versies 8.2.0.0.0, 12.2.1.4.0 en 26.01.0.0.0) en Oracle Business Intelligence Enterprise Edition (versies 8.2.0.0.0 en 26.01.0.0.0).
Interpretaties: De kwetsbaarheden in Oracle BI Publisher en Oracle Business Intelligence Enterprise Edition stellen ongeauthenticeerde aanvallers in staat via HTTP-verzoeken volledige systeemcompromittering te bereiken, authenticatie te omzeilen, willekeurige code uit te voeren, denial of service aanvallen uit te voeren en ongeautoriseerde lees-, update-, insert- of delete-operaties op onderliggende data uit te voeren. Daarnaast kunnen laaggeprivilegieerde aanvallers via de Web Service API authenticatiecontroles omzeilen, wat leidt tot ongeautoriseerde toegang tot gevoelige data, wijziging of verwijdering van kritieke informatie en gedeeltelijke denial of service condities.
Oplossingen: Apache heeft een fix uitgebracht in Apache Log4j versie 2.25.4. Oracle heeft updates uitgebracht voor Oracle BI Publisher en Oracle Business Intelligence Enterprise Edition om de beschreven kwetsbaarheden te verhelpen. Daarnaast is de buffer overflow in de cryptography package opgelost in versie 46.0.7. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-116: Improper Encoding or Escaping of Output
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-131: Incorrect Calculation of Buffer Size
CWE-168: Improper Handling of Inconsistent Special Elements
CVE-2026-34480

Apache Log4j Core's XmlLayout up to version 2.25.3 fails to sanitize forbidden XML 1.0 characters, causing malformed XML output or exceptions depending on the StAX parser, affecting multiple vendors including NetApp, HPE, Oracle, and IBM.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-116 - Improper Encoding or Escaping of Output
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-39892

Certain versions of the cryptography package, specifically from 45.0.0 to before 46.0.7, contain a buffer overflow vulnerability in APIs like Hash.update() when handling non-contiguous buffers on Python versions greater than 3.11, leading to out-of-bounds memory reads and potential crashes.

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-60173

A critical unauthenticated remote code execution vulnerability in Oracle BI Publisher versions 8.2.0.0.0 and 12.2.1.4.0 has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-60671

A critical vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) enables unauthenticated attackers to cause denial of service and unauthorized data manipulation via HTTP, with a CVSS 3.1 score of 8.6.

8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-60673

A vulnerability in Oracle BI Publisher's XML Services affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, enabling low-privileged attackers with HTTP network access to gain unauthorized access to critical or all accessible data, rated CVSS 3.1 base score 6.5.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-60674

A critical vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
CVE-2026-60719

A critical vulnerability in Oracle BI Publisher's Web Service API allows low-privileged attackers with network access to gain unauthorized access, modify or delete data, and cause partial denial of service, rated CVSS 3.1 score 9.9.

9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle BI Publisher
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Business Intelligence Enterprise Edition
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft meerdere kwetsbaarheden verholpen in Oracle BI Publisher (versies 8.2.0.0.0, 12.2.1.4.0 en 26.01.0.0.0) en Oracle Business Intelligence Enterprise Edition (versies 8.2.0.0.0 en 26.01.0.0.0).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden in Oracle BI Publisher en Oracle Business Intelligence Enterprise Edition stellen ongeauthenticeerde aanvallers in staat via HTTP-verzoeken volledige systeemcompromittering te bereiken, authenticatie te omzeilen, willekeurige code uit te voeren, denial of service aanvallen uit te voeren en ongeautoriseerde lees-, update-, insert- of delete-operaties op onderliggende data uit te voeren. Daarnaast kunnen laaggeprivilegieerde aanvallers via de Web Service API authenticatiecontroles omzeilen, wat leidt tot ongeautoriseerde toegang tot gevoelige data, wijziging of verwijdering van kritieke informatie en gedeeltelijke denial of service condities.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Apache heeft een fix uitgebracht in Apache Log4j versie 2.25.4. Oracle heeft updates uitgebracht voor Oracle BI Publisher en Oracle Business Intelligence Enterprise Edition om de beschreven kwetsbaarheden te verhelpen. Daarnaast is de buffer overflow in de cryptography package opgelost in versie 46.0.7. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Encoding or Escaping of Output",
        "title": "CWE-116"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Incorrect Calculation of Buffer Size",
        "title": "CWE-131"
      },
      {
        "category": "general",
        "text": "Improper Handling of Inconsistent Special Elements",
        "title": "CWE-168"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026verbose.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Analytics",
    "tracking": {
      "current_release_date": "2026-07-22T15:22:26.965751Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0259",
      "initial_release_date": "2026-07-22T15:22:26.965751Z",
      "revision_history": [
        {
          "date": "2026-07-22T15:22:26.965751Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle BI Publisher"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Business Intelligence Enterprise Edition"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34480",
      "cwe": {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Encoding or Escaping of Output",
          "title": "CWE-116"
        },
        {
          "category": "other",
          "text": "Improper Handling of Inconsistent Special Elements",
          "title": "CWE-168"
        },
        {
          "category": "description",
          "text": "Apache Log4j Core\u0027s XmlLayout up to version 2.25.3 fails to sanitize forbidden XML 1.0 characters, causing malformed XML output or exceptions depending on the StAX parser, affecting multiple vendors including NetApp, HPE, Oracle, and IBM.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-34480 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34480.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-34480"
    },
    {
      "cve": "CVE-2026-39892",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Calculation of Buffer Size",
          "title": "CWE-131"
        },
        {
          "category": "description",
          "text": "Certain versions of the cryptography package, specifically from 45.0.0 to before 46.0.7, contain a buffer overflow vulnerability in APIs like Hash.update() when handling non-contiguous buffers on Python versions greater than 3.11, leading to out-of-bounds memory reads and potential crashes.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-39892 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39892.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-39892"
    },
    {
      "cve": "CVE-2026-60173",
      "notes": [
        {
          "category": "description",
          "text": "A critical unauthenticated remote code execution vulnerability in Oracle BI Publisher versions 8.2.0.0.0 and 12.2.1.4.0 has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60173 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60173.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60173"
    },
    {
      "cve": "CVE-2026-60671",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) enables unauthenticated attackers to cause denial of service and unauthorized data manipulation via HTTP, with a CVSS 3.1 score of 8.6.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60671 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60671.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60671"
    },
    {
      "cve": "CVE-2026-60673",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle BI Publisher\u0027s XML Services affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, enabling low-privileged attackers with HTTP network access to gain unauthorized access to critical or all accessible data, rated CVSS 3.1 base score 6.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60673 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60673.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60673"
    },
    {
      "cve": "CVE-2026-60674",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60674 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60674.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60674"
    },
    {
      "cve": "CVE-2026-60719",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle BI Publisher\u0027s Web Service API allows low-privileged attackers with network access to gain unauthorized access, modify or delete data, and cause partial denial of service, rated CVSS 3.1 score 9.9.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60719 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60719.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-60719"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.