CVE-2026-83285

CVE-2026-83285 is a high-severity vulnerability in the BI Search component of Oracle Business Intelligence Enterprise Edition (OBIEE) 12.2.1.4.0, part of Oracle Analytics. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, who can then create, delete, or modify critical OBIEE data, gain unauthorized read access to all OBIEE-accessible data, and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), with high confidentiality and integrity impact and low availability impact. Organizations running the affected 12.2.1.4.0 release, especially instances reachable over HTTP or with broadly granted low-privilege accounts, are at risk. No public proof-of-concept or observed in-the-wild exploitation is known, and the CVE is not on the CISA KEV list.

What to do: Apply Oracle's latest Critical Patch Update for OBIEE 12.2.1.4.0 as soon as it is available, since the affected version is the currently supported release. Restrict HTTP access to OBIEE so the BI Search component is reachable only from trusted networks, and audit low-privilege accounts for least-privilege compliance. Review logs for unexpected data creation, deletion, or modification and signs of partial denial of service in BI Search activity.