CVE-2026-83291

CVE-2026-83291 is a vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics), affecting versions 8.2.0.0.0 and 26.01.0.0.0. It is easily exploitable by a low-privileged attacker who already has logon access to the server or infrastructure where OBIEE executes — for example, a local OS user or a low-privilege application account on the same host. Successful exploitation allows the attacker to fully compromise the OBIEE deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8, attack vector local). Because the attack vector is local, the vulnerable surface is the server infrastructure hosting OBIEE rather than the analytics end-user web interface. There is no known public proof of concept and the flaw is not on the CISA Known Exploited Vulnerabilities list, so exploitation in the wild is not indicated.

What to do: Apply the Oracle Critical Patch Update fixes covering CVE-2026-83291 to OBIEE 8.2.0.0.0 and 26.01.0.0.0 deployments as soon as the relevant CPU is available. In the interim, restrict and audit local OS and low-privilege accounts on hosts running OBIEE, enforce least privilege, and monitor those servers for privilege-escalation or unauthorized configuration-change activity.