CVE-2026-83282

CVE-2026-83282 is a critical vulnerability (CVSS 3.1 base score 9.9) in the Platform Security component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0, part of Oracle Analytics. A low-privileged, authenticated attacker with network access via HTTP can send crafted requests that compromise the OBIEE installation and, because the scope changes, may also significantly impact additional products beyond OBIEE itself. Successful exploitation results in a complete takeover of OBIEE with high impact on confidentiality, integrity, and availability, meaning an attacker could read, alter, or destroy business analytics data and pivot to connected systems. Organizations running the affected 12.2.1.4.0 release, especially instances reachable over a network, are at risk. As of now, the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, no public proof-of-concept is known, and no active exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83282 to your OBIEE 12.2.1.4.0 environment as soon as it is available. Restrict network access to OBIEE HTTP endpoints (VPNs, allowlists, WAF rules) so only trusted users can reach the platform, and audit low-privileged accounts for suspicious privilege changes or anomalous activity. Given the scope change, also review access and logs on integrated products that trust OBIEE credentials or share its infrastructure.