PT-2025-42976 · Oracle · Oracle Analytics+1

Published 2025-10-21 · Updated 2025-10-22 · CVE-2025-61754

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 7.6.0.0.0 through 8.2.0.0.0

Description An easily exploitable issue exists in the Web Service API component of Oracle BI Publisher within Oracle Analytics. A low-privileged attacker with network access via HTTP can compromise the application. Successful exploitation may lead to unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data.

Recommendations Update to a version later than 8.2.0.0.0. Update to a version later than 7.6.0.0.0.

Fix

Weakness Enumeration

CWE-267

Related Identifiers

BDU:2025-16363

CVE-2025-61754

Affected Products

Oracle Analytics

Oracle Bi Publisher

References · 6

• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61754 · Security Note
• https://bdu.fstec.ru/vul/2025-16363 · Security Note
• https://twitter.com/CVEnew/status/1980736597814571404 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980829024256438483 · Twitter Post