CVE-2026-83310

CVE-2026-83310 is a high-severity flaw in the BI Platform Security component of Oracle BI Publisher, part of Oracle Analytics, affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It is easily exploitable by a low-privileged attacker with network access via HTTP, but successful attacks require human interaction from a victim other than the attacker — consistent with a cross-site request forgery or similar browser-mediated vector that an admin or other user must be tricked into triggering. A successful exploit allows unauthorized creation, deletion, or modification of critical data, or of all BI Publisher-accessible data, plus unauthorized read access to that data, and because the scope changes, the impact can extend to additional products beyond BI Publisher itself. Organizations running the listed BI Publisher releases (often as part of Oracle Fusion Middleware or Oracle Analytics deployments) on HTTP-reachable networks are affected. There is no known public PoC, no CISA KEV listing, and no evidence of in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that resolves CVE-2026-83310 to all affected BI Publisher installations (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0), prioritizing any instances reachable over HTTP. Verify that BI Publisher and its administrative/reporting consoles are not exposed to the public internet, and audit low-privileged accounts for suspicious data changes, since scope change means related products could be affected. Because exploitation requires victim interaction, remind BI Publisher users not to click untrusted links while authenticated to the platform.