CVE-2026-83296

CVE-2026-83296 is a difficult-to-exploit vulnerability in the BI Search component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics. A remote attacker who already holds low-privileged credentials and has HTTP network access to the OBIEE server can trigger the flaw, and a successful attack results in a full takeover of the OBIEE installation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.5, AV:N/AC:H/PR:L/UI:N/S:U). The affected releases are versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Exploitation status: no public proof-of-concept is known, the flaw is not on the CISA Known Exploited Vulnerabilities list, and there are no reports of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83296 to all OBIEE instances running versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. Verify that BI Search and analytics consoles are not exposed to untrusted networks, and restrict low-privileged BI user accounts to least-privilege roles. Review authentication and audit logs for anomalous activity by low-privilege accounts against the BI Search component.