CVE-2026-83304

CVE-2026-83304 is a difficult-to-exploit, unauthenticated vulnerability in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition (OBIEE), reachable by a remote attacker with network access over HTTP. Successful exploitation lets an unauthenticated attacker create, delete, or modify critical data, read all data accessible to the compromised OBIEE instance, and cause a partial denial of service; because the vulnerability has a scope change (S:C), successful attacks may also significantly impact products beyond OBIEE itself. It carries a CVSS 3.1 base score of 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L), with the high attack-complexity rating making reliable exploitation harder. Affected deployments are organizations running OBIEE versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 whose Analytics Web endpoints are reachable by untrusted network users. There is no known public proof of concept and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to all OBIEE 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 installations, prioritizing any instance whose Analytics Web URL is reachable from untrusted networks. Restrict HTTP access to Analytics Web via firewalls, reverse proxies with authentication, or VPN so it is not directly internet-facing, and review access logs and data-change history on the BI server for signs of unauthorized modification, data exfiltration, or unexpected service disruption. Because of the scope change, also inspect adjacent systems and data sources that the compromised OBIEE instance could reach.