CVE-2026-83288

CVE-2026-83288 is a local privilege escalation flaw in the BI Search component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. It is exploited by an attacker who already holds a low-privileged logon on the infrastructure (host) where OBIEE executes; Oracle rates it as easily exploitable, requiring low privileges and no user interaction (CVSS 3.1 base 7.8, AV:L/PR:L). Successful attacks allow complete takeover of the OBIEE deployment, with high impact on confidentiality, integrity, and availability. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. There is no known public proof-of-concept and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83288 to every OBIEE installation running version 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0, prioritizing hosts shared by multiple users or service accounts. Since exploitation requires only a low-privileged local logon, restrict OS-level accounts on BI servers to trusted administrators and apply least privilege. Review BI server logs for unexpected privilege escalation, new account creation, or configuration changes to BI Search components.