CVE-2026-83322

An easily exploitable vulnerability in the Platform Security component of Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics) allows a high-privileged attacker with network access via HTTP to fully compromise the BI platform. Exploitation requires valid high-privileged credentials or a compromised administrator account, sending crafted requests to the product's HTTP interface. A successful attack results in complete takeover of Oracle BI EE with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.2). Affected installations are versions 8.2.0.0.0 and 26.01.0.0.0; no public PoC is known and the flaw is not listed in CISA's KEV, so exploitation is not currently observed.

What to do: Apply Oracle's Critical Patch Update (CPU) remediation for this CVE to all instances of OBIEE 8.2.0.0.0 and 26.01.0.0.0 as soon as it is available. Restrict HTTP access to the BI platform and its administrative interfaces to trusted networks or VPN, and enforce MFA and least-privilege for high-privileged BI accounts. Audit privileged users and review logs on affected hosts for anomalous activity indicative of misuse of this flaw.