CVE-2026-83324

CVE-2026-83324 is a difficult-to-exploit vulnerability in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition (part of Oracle Analytics). A low-privileged attacker with network access via HTTP who successfully exploits the flaw can gain unauthorized creation, deletion, or modification access to critical data or all OBIEE-accessible data, as well as unauthorized read access to a subset of that data. Because the vulnerability has a scope change, successful attacks may also significantly impact additional products beyond OBIEE itself. Affected deployments are those running versions 8.2.0.0.0 or 26.01.0.0.0. No public proof-of-concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so there is no indication of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediated CVE-2026-83324 for versions 8.2.0.0.0 and 26.01.0.0.0 as soon as your change window allows. Restrict HTTP access to OBIEE consoles to trusted networks/VPNs and enforce least-privilege role assignments, since exploitation requires an authenticated low-privileged account. Review audit logs for unexpected data creation, deletion, or modification by low-privilege BI users and for any suspicious cross-product impact, given the scope change.