CVE-2026-83284

CVE-2026-83284 is an easily exploitable vulnerability in the BI Platform Security component of Oracle BI Publisher, part of Oracle Analytics. An unauthenticated attacker with network access to the product's SOAP interface can trigger the flaw with no credentials and no user interaction. Successful exploitation allows the attacker to hang or repeatedly crash the BI Publisher service (complete denial of service), as well as gain unauthorized read access and unauthorized update, insert, or delete access to a subset of data reachable through BI Publisher. Versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 are confirmed affected. No public proof-of-concept exists, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update (CPU) that remediates CVE-2026-83284 to every affected BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 deployment as soon as the patch is released. Until patched, restrict access to BI Publisher SOAP endpoints (block internet exposure, allow-list trusted sources) and review logs for unauthenticated SOAP requests, unexplained service hangs or crashes, and unauthorized data changes. If SOAP access is not required, disable the interface or place it behind an authenticated reverse proxy.