CVE-2026-83307 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting the Oracle BI Publisher product line across supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This security flaw is classified as a critical risk due to its high exploitability by low-privileged attackers who possess network access via the HTTP protocol. The vulnerability allows an attacker with minimal authentication privileges to compromise the integrity of the BI Publisher environment without requiring user interaction or complex social engineering tactics, indicating that the attack vector is remote and requires only local-level credentials on the target system.
From a technical perspective, the flaw likely stems from insufficient validation or access control mechanisms within the HTTP handling routines of the BI Platform Security module. This deficiency enables an authenticated attacker to manipulate requests in ways that bypass intended security boundaries. The absence of proper authorization checks allows the execution of administrative functions or data manipulation operations that should be restricted to higher-privileged users. Consequently, this represents a classic instance of broken access control where the system fails to enforce separation between different user roles and their permitted actions on sensitive resources.
The operational impact of exploiting this vulnerability is severe, encompassing significant breaches in confidentiality, integrity, and availability as reflected by the CVSS 3.1 Base Score of 8.3. Successful exploitation grants unauthorized actors the ability to create, delete, or modify critical data within Oracle BI Publisher. This level of access extends beyond just specific datasets; it can lead to complete compromise of all accessible data managed by the platform. Furthermore, attackers may gain unrestricted read access to sensitive information, leading to substantial confidentiality breaches that could expose proprietary business intelligence reports, customer data, or financial records depending on the organization's usage patterns.
In addition to data manipulation and theft, the vulnerability also impacts system availability. Attackers can trigger conditions that result in a partial denial of service against Oracle BI Publisher services. This means that while full system shutdown might not be guaranteed, critical functionalities such as report generation, dashboard loading, or user authentication processes could become degraded or unresponsive for legitimate users. Such disruptions hinder business operations and demonstrate the potential for this vulnerability to serve as an entry point for broader infrastructure disruption campaigns if left unpatched.
This incident aligns with Common Weakness Enumeration (CWE) categories such as CWE-269 Improper Privilege Management, which covers scenarios where a user is granted more privileges than necessary, and potentially CWE-862 Missing Authorization, describing the failure to enforce access control rules. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK framework entries like T1078 Valid Accounts, as it relies on low-privileged credentials, and T1530 Data from Cloud Storage or T1486 Data Encrypted for Impact if the attacker proceeds to exfiltrate or destroy data after gaining access. The network-based nature of the exploit via HTTP also highlights risks associated with web application vulnerabilities where input validation is insufficient.
To mitigate this risk, organizations running affected versions of Oracle BI Publisher must immediately apply the latest security patches provided by Oracle. It is imperative to verify that all instances within the enterprise environment are updated to a version free from this vulnerability. In addition to patching, administrators should enforce strict network segmentation policies to limit HTTP access to only authorized management networks where possible. Implementing robust Web Application Firewalls can provide an additional layer of defense by detecting and blocking anomalous request patterns associated with privilege escalation attempts. Regular audits of user permissions are also recommended to ensure that the principle of least privilege is strictly maintained, reducing the attack surface available to low-privileged accounts should similar vulnerabilities be discovered in the future.