CVE-2026-83301

CVE-2026-83301 is an easily exploitable vulnerability in the Service Administration UI of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics, affecting version 12.2.1.4.0. A remote attacker who already has a low-privileged (authenticated) account and network access via HTTP can trigger the flaw to fully compromise the OBIEE installation, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Any organization running the affected 12.2.1.4.0 release, especially where the analytics or administration consoles are reachable over the network, is exposed. There is no known public proof-of-concept, the issue is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported. Because exploitation requires only low privileges and no user interaction, it should still be treated as a high-priority patch for OBIEE deployments.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-83301 to all OBIEE 12.2.1.4.0 instances as soon as it is available. Restrict network access to the Service Administration UI and analytics consoles (VPN/IP allowlisting, WAF rules) and ensure they are not internet-facing. Review low-privileged BI user accounts for anomalous logins or privilege changes and rotate credentials on affected systems.