Oracle BI Publisher vulnerabilities

43 CVEs affecting Oracle BI Publisher, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71059, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2021-2401, published 2021-07-21. Medium severity, CVSS 5.3. EPSS: 84.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and…
CVE-2021-2400, published 2021-07-21. High severity, CVSS 7.5. EPSS: 83.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and…
CVE-2021-21346, published 2021-03-23. Critical severity, CVSS 9.8. EPSS: 76.4% chance of exploitation in the next 30 days. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code…
CVE-2021-2396, published 2021-07-21. High severity, CVSS 8.8. EPSS: 35.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and…
CVE-2021-2391, published 2021-07-21. High severity, CVSS 8.8. EPSS: 34.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily…
CVE-2019-2767, published 2019-07-23. High severity, CVSS 7.2. EPSS: 5.2% chance of exploitation in the next 30 days. Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0,…
CVE-2021-2392, published 2021-07-21. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and…
CVE-2022-21346, published 2022-01-19. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily…

Latest

CVE-2026-71059, published 2026-08-18. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0 and 26.1.0.0.0. Easily exploitable…
CVE-2026-71058, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable…
CVE-2026-71057, published 2026-08-18. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.1.0.0.0. Easily…
CVE-2026-61305, published 2026-08-18. High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily…
CVE-2026-60719, published 2026-07-21. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable…
CVE-2026-60673, published 2026-07-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable…
CVE-2026-60173, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable…
CVE-2025-61754, published 2025-10-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0. Easily exploitable vulnerability…
CVE-2025-50060, published 2025-07-15. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable…
CVE-2025-30724, published 2025-04-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability…