CVE-2026-83071

CVE-2026-83071 is a high-severity flaw (CVSS 3.1: 7.8) in the Machine Learning component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics, affecting versions 8.2.0.0.0 and 26.01.0.0.0. It is easily exploitable by a low-privileged attacker who already has a logon on the server or infrastructure where OBIEE executes — the attack vector is local, with low complexity, low privileges required, and no user interaction. Successful exploitation allows the attacker to fully compromise the OBIEE deployment, with high impact on confidentiality, integrity, and availability — effectively a complete takeover of the platform. Because exploitation requires existing local access, the risk is concentrated in environments where untrusted or broadly shared OS accounts can reach BI infrastructure. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no evidence of exploitation in the wild.

What to do: Apply Oracle's Critical Patch Update remediation for CVE-2026-83071 to all OBIEE instances running versions 8.2.0.0.0 or 26.01.0.0.0. Enforce least privilege and tightly restrict or audit local OS accounts on servers hosting OBIEE, since the flaw is exploitable only by users with logon to that infrastructure. Investigate any history of low-privileged accounts elevating privileges or accessing BI data unexpectedly on affected hosts.