CVE-2026-83283

CVE-2026-83283 is a critical (CVSS 9.8) flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), affecting version 12.2.1.4.0. It is triggered remotely over HTTP by an attacker with no credentials and no user interaction, requiring only network reachability to the OBIEE service. A successful exploit allows complete takeover of the OBIEE installation, with high impact on confidentiality, integrity, and availability — including access to sensitive analytics data, reports, and potentially connected backend data sources. Organizations running the affected 12.2.1.4.0 release, especially those with OBIEE consoles reachable from untrusted networks, are at risk. There is no known public proof of concept and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83283 to all OBIEE 12.2.1.4.0 installations as soon as possible; since 12.2.1.4.0 is the terminal OBIEE release, also plan migration to Oracle Analytics Server for continued security support. Restrict HTTP/HTTPS access to OBIEE consoles via firewall rules or VPN so they are not reachable from untrusted networks. Review BI service accounts, administrative users, and audit logs for signs of unauthorized access following patching.