CVE-2026-83307

CVE-2026-83307 is a vulnerability in the BI Platform Security component of Oracle BI Publisher (part of Oracle Analytics) that allows a low-privileged, authenticated attacker with HTTP network access to compromise the application. Successful attacks can result in unauthorized creation, deletion, or modification of critical data or all BI Publisher accessible data, unauthorized read access to that data, and a partial denial of service. Exploitation requires no user interaction and is rated CVSS 3.1 8.3 (high), with high confidentiality and integrity impacts and low availability impact. Affected deployments are Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, which are widely used in enterprise reporting and analytics environments. No public proof-of-concept is known and the flaw is not on the CISA KEV list, indicating no confirmed in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83307 to all BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 deployments. Restrict HTTP access to BI Publisher consoles and report endpoints so only trusted networks and authenticated users can reach them, and enforce least-privilege roles for BI Platform Security. Review audit logs for suspicious data modification, deletion, or unexpected access by low-privilege accounts, and monitor for partial DoS symptoms such as abnormal service degradation.