CVE-2026-83305 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting Oracle BI Publisher versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This flaw represents a critical security deficiency that permits unauthenticated attackers to compromise the integrity and availability of the application through network access via HTTP. The absence of required authentication checks allows any remote actor with connectivity to the target system to exploit this weakness without prior credentials or user interaction, significantly lowering the barrier for entry compared to authenticated attacks.
From a technical perspective, the vulnerability enables unauthorized access to critical data stored within the BI Publisher environment. This includes both read and write capabilities over sensitive information assets. The attacker can perform unauthorized updates, insertions, or deletions of data accessible by the application, which directly impacts the integrity of the system's content. Furthermore, the flaw allows for actions that lead to a partial denial of service, disrupting normal operations and degrading performance for legitimate users. This combination of confidentiality breach, integrity violation, and availability impact results in a high-severity rating with a CVSS 3.1 Base Score of 8.6. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) confirms that the attack is network-based, requires low complexity, involves no privileges or user interface interaction for initiation, and results in high confidentiality impact alongside limited integrity and availability impacts.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication, as it allows an unauthenticated actor to perform actions that should be restricted. The ability to modify data corresponds to CWE-369 Denial of Service via Crash or Diversion of Traffic if the partial DOS involves resource exhaustion, and potentially CWE-77 SQL Injection or similar injection flaws depending on the specific implementation details not fully disclosed in the summary but implied by the write capabilities. From an offensive security framework perspective, this vulnerability facilitates initial access and privilege escalation within the application layer, mapping to MITRE ATT&CK techniques such as T1078 Valid Accounts if credentials are later harvested or T1496 Resource Hijacking if resources are consumed during the denial of service phase. The lack of authentication bypass is a primary concern for organizations relying on BI Publisher for enterprise reporting and data analysis.
The operational impact of this vulnerability is severe, as it compromises the trust model of the Oracle Analytics platform. Unauthorized access to critical data can lead to significant business intelligence leaks, regulatory non-compliance due to exposure of personally identifiable information or proprietary metrics, and potential financial loss from manipulated reports. The ability to delete or alter data undermines the reliability of decision-making processes that depend on accurate BI outputs. Additionally, partial denial of service conditions can halt reporting workflows during critical periods, affecting productivity and stakeholder confidence in the system's uptime and stability.
Mitigation strategies must prioritize immediate remediation through patching. Organizations should apply the latest security updates provided by Oracle for their specific version of Oracle Analytics to address this flaw. In environments where patching is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to block requests exhibiting patterns associated with exploitation attempts. Access control lists should restrict HTTP access to BI Publisher endpoints only from trusted IP ranges or internal networks, reducing the attack surface exposed to unauthenticated actors. Regular security audits and penetration testing focused on authentication mechanisms are recommended to identify similar weaknesses in other components of the analytics suite.