CVE-2026-83320

CVE-2026-83320 is a high-severity (CVSS 7.6) vulnerability in the Administration component of Oracle BI Publisher, part of Oracle Analytics, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A low-privileged attacker with network access via HTTP can trigger the flaw, but a successful attack requires a human victim (other than the attacker) to interact — a pattern consistent with a CSRF-style attack against the administrative interface. If exploited, the attacker can gain unauthorized read access to critical data or all data accessible to BI Publisher, as well as unauthorized update, insert or delete access to some of that data; because the scope changes, attacks may also significantly impact products beyond BI Publisher itself. Organizations running on-premises BI Publisher (standalone or as part of Oracle Analytics Server / Fusion Middleware) are the primary affected population, especially any instance with the admin console reachable by low-privilege or internal users. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is not currently known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83320 to all BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 installations. In the interim, restrict network access to BI Publisher administration pages (including /xmlpserver) to trusted administrative networks, enforce strict SameSite cookie behavior where supported, and review logs for anomalous data access by low-privilege accounts. Verify no internet-facing exposure of the admin console using external scanning.