CVE-2026-83303

CVE-2026-83303 is an authorization flaw in the BI Platform Security component of Oracle BI Publisher, part of Oracle Analytics, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A remote attacker holding only low-privileged credentials can trigger the flaw over the network through the SOAP interface, and it is rated as easily exploitable. Successful attacks allow the attacker to compromise Oracle BI Publisher entirely, gaining unauthorized creation, deletion or modification access to critical data or all BI Publisher-accessible data, along with unauthorized read access to a subset of that data. Because the vulnerability carries a scope change, successful attacks may also significantly impact additional products beyond BI Publisher itself. The issue is rated CVSS 3.1 8.5 (high); it is not on the CISA KEV list, no public PoC is known, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83303 to all affected BI Publisher installations (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0). Until patched, restrict network access to the BI Publisher SOAP interface and audit low-privileged accounts for anomalous SOAP requests or unexpected data changes. Because of the scope change, also verify the integrity of data in integrated systems reachable from BI Publisher.