CVE-2026-83293

A local privilege escalation vulnerability exists in the FNDN component of Oracle Business Intelligence Enterprise Edition (OBIEE) 12.2.1.4.0, part of Oracle Analytics. It is easily exploitable by a low-privileged attacker who already has logon access to the host or infrastructure where OBIEE executes, requiring no user interaction. Successful exploitation allows the attacker to fully compromise the OBIEE deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Any organization running the affected 12.2.1.4.0 release of OBIEE is exposed, primarily through local accounts or lateral movement on BI server infrastructure. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no observed in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remedies CVE-2026-83293 to all OBIEE 12.2.1.4.0 installations. Restrict and audit local OS accounts on BI middleware hosts, enforce least privilege, and monitor for unexpected privilege elevation or process execution under the BI service accounts. Verify that development, test, and disaster-recovery instances are patched as well, since local-access flaws affect every tier, not just production.