CVE-2026-83295

CVE-2026-83295 is a difficult-to-exploit vulnerability in the Presentation Services component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. It is triggered by a low-privileged authenticated attacker sending crafted requests to the product's SOAP interface over the network, and successful exploitation allows complete takeover of the OBIEE installation with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, which are widely deployed on-premises BI installations at mid-size and large organizations. The high attack complexity and requirement for valid low-privileged credentials reduce the likelihood of opportunistic attacks, and no public proof-of-concept or confirmed in-the-wild exploitation is known. The vulnerability is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83295 to all affected OBIEE installations on versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. Restrict network access to OBIEE SOAP endpoints (and the product generally) to trusted internal users and VPN ranges, and audit low-privileged accounts for anomalous activity or unexpected privilege changes. Verify that BI Presentation Services consoles are not exposed to the public internet.