CVE-2026-83284 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle BI Publisher as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting the Oracle BI Publisher product across supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This security flaw is characterized by its high severity, with a CVSS 3.1 Base Score of 8.6, indicating significant risk to confidentiality, integrity, and availability. The vulnerability stems from an easily exploitable defect that permits unauthenticated attackers who possess network access via the SOAP interface to compromise the underlying system. Because no authentication is required for exploitation, this represents a critical exposure where any entity capable of reaching the service endpoint over the network can initiate malicious interactions without prior credentials or user interaction.
From a technical perspective, the flaw allows an attacker to manipulate data and disrupt services through direct manipulation of SOAP requests. The operational impact is multifaceted, encompassing both denial-of-service conditions and unauthorized data access. Specifically, successful exploitation enables the attacker to cause a hang or trigger frequently repeatable crashes that result in complete denial of service for Oracle BI Publisher users. This availability impact ensures that legitimate business operations relying on reporting and analytics capabilities are interrupted. Furthermore, beyond disruption, the vulnerability grants unauthorized read access to a subset of accessible data within the application. This breach of confidentiality allows sensitive information stored or processed by the system to be exfiltrated without authorization.
In addition to reading data, the attacker gains the ability to perform unauthorized updates, inserts, and deletes on Oracle BI Publisher accessible data. This compromise of integrity means that an adversary can alter existing records, inject malicious new entries, or remove critical datasets, potentially leading to corrupted reports, misleading analytics outputs, or permanent loss of information depending on backup and recovery procedures. The combination of these capabilities creates a severe threat landscape where the trustworthiness of the entire BI platform is undermined. An attacker could theoretically modify configuration settings, alter report definitions, or delete audit logs to cover their tracks while maintaining persistent access through data manipulation.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if the crash is memory-related, though the primary classification centers on insufficient authentication controls leading to unauthorized actions. In terms of MITRE ATT&CK mapping, this behavior corresponds to techniques involving Initial Access via network services like SOAP, followed by Impact tactics including Data Manipulation for integrity compromise and Service Exhaustion for availability denial. The lack of required privileges places it in the category of unauthenticated attacks, which are particularly dangerous as they do not require social engineering or credential theft phases.
Mitigation strategies must focus on immediate remediation through patching to the latest available version provided by Oracle that addresses this specific flaw within the BI Platform Security component. Organizations should also implement network-level controls such as firewall rules or web application firewalls to restrict access to the SOAP endpoints exclusively from trusted IP ranges if remote access is not strictly necessary. Additionally, enabling robust logging and monitoring for anomalous SOAP request patterns can aid in early detection of exploitation attempts. Regular security assessments and penetration testing focused on API interfaces are recommended to identify similar weaknesses before they can be exploited by malicious actors seeking to disrupt business continuity or steal sensitive corporate data.