CVE-2026-83287

CVE-2026-83287 is a vulnerability in the Presentation Services component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. A low-privileged (authenticated) attacker with network access to the product's SOAP interface can exploit the flaw easily and, because of a scope change, may gain unauthorized access to critical data or complete access to all data reachable through the affected OBIEE deployment, potentially including data from additional products. Only confidentiality is impacted (no integrity or availability impact per the CVSS vector), but the scope change means data beyond OBIEE itself could be exposed. Affected deployments are those running versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 that expose SOAP services to low-privilege users. No public proof of concept is known and the flaw is not on the CISA KEV list, indicating no observed in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83287 to all OBIEE instances on 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. Restrict network access to SOAP/Presentation Services endpoints so only trusted users and networks can reach them, and review which low-privilege accounts can authenticate to those endpoints. Audit logs for anomalous data access by low-privilege accounts, given the scope-change potential for exposure of data in connected products.