CVE-2026-83294

CVE-2026-83294 is a high-severity (CVSS 7.8) flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (OBIEE), affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. An unauthenticated attacker who already has logon access to the server or infrastructure hosting OBIEE can exploit this easily, but the attack requires human interaction from a person other than the attacker — most plausibly tricking a legitimate user on the system into performing an action (e.g., opening a malicious file or link) that triggers the compromise. A successful attack can result in a full takeover of OBIEE, with high impact on the confidentiality, integrity, and availability of the analytics platform and the business data it holds. Organizations running the listed OBIEE versions on shared or multi-user infrastructure are primarily at risk, since the attack vector is local rather than remote/network. The flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83294 to all OBIEE 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 installations. Restrict OS-level logon access to OBIEE hosts to only necessary administrators and service accounts, since the attack requires local presence plus user interaction. Brief users with access to these servers to avoid opening untrusted files or links, and review authentication and audit logs on affected hosts for anomalous activity.