CVE-2026-83308

An easily exploitable vulnerability in the BI Platform Security component of Oracle BI Publisher allows a low-privileged, authenticated attacker with network access to compromise the application through its SOAP interface. Successful attacks can result in unauthorized creation, deletion, or modification of critical data or all data accessible to BI Publisher, as well as the ability to cause a hang or frequently repeatable crash (complete denial of service). Organizations running BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 as part of Oracle Analytics deployments are affected. The flaw carries a CVSS 3.1 base score of 8.1 (high), reflecting a network attack vector with low privileges required and high impact on both integrity and availability. No public proof of concept is known and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is currently no evidence of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83308 to every installation of BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Until patched, restrict network access to BI Publisher SOAP endpoints to trusted sources and enforce least-privilege credentials for service and reporting accounts. Review audit logs for unauthorized data changes or repeated crashes and hangs attributable to low-privileged accounts.