CVE-2026-83297 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting the Oracle BI Publisher product across supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This security flaw is characterized by an easily exploitable condition that permits a low-privileged attacker to compromise the integrity of the system through network access via LDAP protocols. The presence of this vulnerability indicates a significant weakness in how authentication or authorization mechanisms handle inputs derived from Lightweight Directory Access Protocol connections, allowing malicious actors to bypass expected privilege restrictions and execute unauthorized operations within the BI Publisher environment.
From a technical perspective, the core issue involves improper validation or handling of data received through LDAP interactions, which serves as an attack vector for escalating privileges beyond what is normally permitted by user roles. The vulnerability allows attackers with low-level access credentials to manipulate critical system functions that should be restricted to higher-privileged administrators. This misalignment in security controls enables actions such as the unauthorized creation, deletion, or modification of data within the BI Publisher repository. Furthermore, it grants the ability to read sensitive information that would otherwise remain inaccessible, effectively breaking down the isolation boundaries between different user privilege levels and compromising the overall trust model of the application architecture.
The operational impact of this vulnerability is severe, as evidenced by a CVSS 3.1 Base Score of 8.1, which classifies it as High severity with significant impacts on Confidentiality and Integrity while leaving Availability largely unaffected according to the provided vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The high confidentiality impact signifies that attackers can access all Oracle BI Publisher accessible data, potentially exposing proprietary business intelligence reports, customer information, and strategic analytics. Simultaneously, the high integrity impact means that adversaries can alter or destroy critical datasets, leading to potential financial loss, regulatory non-compliance, and erosion of stakeholder trust due to corrupted reporting outputs. The network-based nature of the attack vector combined with low authentication requirements makes this a particularly dangerous threat for organizations relying on remote access capabilities within their BI infrastructure.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as it allows an actor to perform actions without proper authorization levels. Additionally, the exploitation method involving LDAP interactions may relate to CWE-749 Exposed Dangerous Method or specific injection flaws depending on the exact implementation details of how LDAP data is processed within the BI Platform Security module. From a tactical standpoint, this aligns with MITRE ATT&CK techniques such as T1078 Valid Accounts and potentially T1530 Data from Cloud Storage if the compromised data resides in cloud-linked repositories, highlighting the risk of lateral movement and data exfiltration once initial access is gained through these weak points.
To mitigate this vulnerability, organizations must immediately apply the latest security patches provided by Oracle for all affected versions of BI Publisher. It is critical to verify that all instances running version 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 are updated to a patched release where the LDAP handling logic has been corrected. In addition to patching, administrators should enforce strict network segmentation policies to limit direct access to BI Publisher components from untrusted networks and implement robust monitoring for anomalous LDAP query patterns that deviate from normal operational baselines. Regular audits of user privileges within the BI Platform Security module are also recommended to ensure that low-privileged accounts do not possess excessive permissions, thereby reducing the blast radius should a similar vulnerability be discovered in the future.