CVE-2026-83335

CVE-2026-83335 is a high-severity flaw (CVSS 3.1: 8.8) in the Analytics Server component of Oracle Business Intelligence Enterprise Edition, affecting versions 8.2.0.0.0 and 26.01.0.0.0. It is described by Oracle as easily exploitable by a low-privileged (i.e., authenticated with minimal rights) attacker who has network access to the server over HTTP. Successful exploitation allows the attacker to fully take over the Oracle BI Enterprise Edition deployment, with high impact on the confidentiality, integrity, and availability of the platform and its data. Organizations running the affected on-premises Analytics Server releases are exposed wherever the service is reachable by low-trust users, and the risk is greatest for instances with HTTP endpoints exposed to broader networks. No public proof-of-concept exists, there is no evidence of in-the-wild exploitation, and the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83335 to all deployments of versions 8.2.0.0.0 and 26.01.0.0.0. Restrict HTTP access to Analytics Server endpoints (consoles and web services) to trusted networks or VPN, and verify no instances are unintentionally internet-facing. Review low-privileged BI account activity for anomalies and rotate credentials on systems where suspicious access is found.