CVE-2026-83290

CVE-2026-83290 is a vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics, affecting versions 8.2.0.0.0 and 26.01.0.0.0. The flaw is easily exploitable by a low-privileged attacker who already has logon access to the host where OBIEE executes (attack vector: local), requiring no user interaction. A successful attack allows the attacker to compromise the entire OBIEE deployment, with high impact on confidentiality, integrity, and availability — effectively a takeover of the platform (CVSS 3.1 base score 7.8). Organizations running the affected on-premises versions with multiple local OS or application accounts on BI servers are the primary concern. No public proof-of-concept exists and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that remedies this issue to OBIEE 8.2.0.0.0 and 26.01.0.0.0 environments, prioritizing hosts with many local or interactive accounts. Restrict and audit local OS accounts on BI servers, and review privilege boundaries between low-privileged users and the OBIEE runtime. Check for signs of unauthorized local account activity or unexpected elevation on affected servers.