CVE-2026-83273

CVE-2026-83273 is a vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics, affecting supported version 26.01.0.0.0. It is easily exploitable by an attacker who already holds high privileges and has network access to the OBIEE server via HTTP, allowing them to fully compromise the product. A successful attack results in complete takeover of the OBIEE installation, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). Organizations running the affected version are exposed, particularly if the OBIEE console or related HTTP endpoints are reachable by untrusted or semi-trusted users, since any compromised high-privileged account (for example through credential theft or insider misuse) becomes a path to full system takeover. There is no known public proof of concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no active exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses this issue to all OBIEE 26.01.0.0.0 installations as soon as it is available. Restrict HTTP access to OBIEE consoles and analytics endpoints via firewall rules, reverse proxies, or VPN so only trusted administrators can reach them, and enforce least-privilege role assignments to limit who holds the high privileges required for exploitation. Finally, audit high-privileged OBIEE accounts and review access logs for anomalous activity indicative of credential misuse.