CVE-2026-83289

CVE-2026-83289 is a difficult-to-exploit vulnerability in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. An authenticated, low-privileged attacker with network access to the product's SOAP interface can exploit the flaw, and a successful attack results in a complete takeover of the OBIEE installation, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). The high attack complexity (AC:H) and requirement for at least low-level credentials make opportunistic attacks less likely, but any attacker with a valid low-privilege account and network reachability to the SOAP endpoints is a plausible threat. Affected deployments are on-premises enterprise BI environments running versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. No public proof of concept is known, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update fixes for the Analytics Web General component on all affected versions (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0). Restrict network access to OBIEE SOAP endpoints to trusted internal users and VPN clients, and review low-privileged account activity for anomalous SOAP requests. Monitor Oracle's CPU advisory for this CVE and verify patch levels across all analytics servers in the environment.