CVE-2026-83297

CVE-2026-83297 is a flaw in the BI Platform Security component of Oracle BI Publisher (part of Oracle Analytics) affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access via LDAP can exploit it easily (no user interaction required) to compromise Oracle BI Publisher. Successful attacks give the attacker unauthorized ability to create, delete, or modify critical data — or all BI Publisher-accessible data — as well as unauthorized read access up to complete disclosure of that data; availability is not impacted (CVSS 3.1 base score 8.1, high confidentiality and integrity impact). The flaw is presumably addressed in an Oracle Critical Patch Update, and defenders running the listed versions, especially those with LDAP-integrated authentication, are affected. There is no evidence of in-the-wild exploitation: the CVE is not in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83297 to all Oracle BI Publisher deployments on versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. Until patched, restrict network and LDAP access to BI Publisher to trusted sources, enforce least-privilege LDAP bind accounts, and review logs for suspicious data modifications or access by low-privilege accounts.