CVE-2026-83305

CVE-2026-83305 is an unauthenticated vulnerability in the BI Platform Security component of Oracle BI Publisher, part of Oracle Analytics. An unauthenticated attacker with network access via HTTP can exploit it easily to compromise the BI Publisher instance, gaining unauthorized read access to critical data — potentially all data accessible to the product — plus unauthorized update, insert, and delete access to some data, and the ability to cause a partial denial of service. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The flaw carries a CVSS 3.1 base score of 8.6 (high), driven by high confidentiality impact. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply Oracle's Critical Patch Update that remediates this CVE on all affected Oracle BI Publisher deployments (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) as soon as it is available. Restrict network access to BI Publisher HTTP endpoints so only trusted users and networks can reach the service, and place it behind an authenticated reverse proxy or VPN where possible. Review logs for unauthenticated HTTP requests to BI Platform Security endpoints and investigate any anomalous data exports, unauthorized modifications, or partial service outages.