CVE-2026-83321

A high-severity (CVSS 3.1: 8.5) vulnerability in the Analytics Actions component of Oracle Business Intelligence Enterprise Edition (OBIEE), part of Oracle Analytics, allows a low-privileged authenticated attacker with network access via HTTP to compromise the product. Exploitation is described by Oracle as easy, and because the flaw changes scope, a successful attack may also significantly impact additional products beyond OBIEE itself. The impact is unauthorized access to critical data or complete access to all OBIEE-accessible data, plus unauthorized update, insert, or delete access to some of that data; availability is not affected. Affected deployments are those running version 8.2.0.0.0 or 26.01.0.0.0. There is no known public proof of concept and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw to all OBIEE instances on 8.2.0.0.0 or 26.01.0.0.0. Restrict HTTP access to OBIEE consoles so they are not internet-facing, and enforce least-privilege roles for low-privileged BI accounts. Review audit logs for anomalous data reads or unexpected insert/update/delete activity by low-privilege users, and check whether other products integrated with OBIEE were reachable in the event of scope change.