CVE-2018-2925: Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Server).

Security readout for executives and security teams

CVE-2018-2925 is a confidentiality flaw in Oracle BI Publisher. A low-privileged attacker who can reach the service over HTTP could gain unauthorized access to critical BI Publisher data, potentially all data accessible through the application. Exposure is most likely where affected BI Publisher versions are reachable over HTTP by authenticated low-privileged users, including internal users, partners, or compromised accounts with network access. Treat as a near-term data exposure risk, especially if BI Publisher contains sensitive reporting data. Prioritize patch verification and exposure review, but do not assume active exploitation from the supplied evidence. Mitigation focus: Review Oracle's July 2018 Critical Patch Update for BI Publisher guidance.; Apply vendor-supported patches or upgrades for affected BI Publisher versions.; Prioritize systems exposing BI Publisher over broad internal or external networks..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.