CVE-2026-83309 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Web Server component of Oracle BI Publisher, a core part of the Oracle Analytics suite. This security flaw affects multiple supported versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The nature of this vulnerability allows for exploitation by an attacker who possesses low-level privileges but has network access to the target system via HTTP. This indicates that the attack vector is remote and does not require user interaction or complex authentication bypasses beyond basic account credentials, making it a significant risk in environments where internal users have standard access rights. The ease of exploitation combined with the broad reach through web protocols means that any authenticated low-privilege user can potentially trigger this flaw to compromise the integrity and confidentiality of the system.
The technical impact of exploiting this vulnerability is severe, leading directly to unauthorized access to critical data stored within Oracle BI Publisher. Successful exploitation grants the attacker not only read access but also write capabilities, including the ability to update, insert, or delete accessible data. This dual impact on both confidentiality and integrity aligns with a CVSS 3.1 Base Score of 8.5, classified as High severity. The specific vector components AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N highlight that while availability is not directly impacted, the scope change indicates that compromising Oracle BI Publisher can lead to broader system compromise beyond just the application itself. This suggests potential for lateral movement or privilege escalation depending on how the underlying Web Server and database components are configured and integrated within the enterprise architecture.
From a classification perspective, this vulnerability maps closely to CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization if the flaw allows actions without sufficient permission checks. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques such as T1078 Valid Accounts for initial access via low privileged credentials, followed by T1530 Data from Local System or T1046 Network Service Scanning if the attacker uses the compromised BI Publisher instance to probe further. The ability to modify data also relates to T1565 Data Manipulation which can be used to alter reports or inject malicious content into published outputs, thereby affecting decision-making processes within the organization that rely on these analytics.
The operational impact extends beyond simple data theft because Oracle BI Publisher is often integrated with other enterprise systems and databases. An attacker gaining write access could corrupt analytical reports, leading to incorrect business intelligence outcomes. Furthermore, since attacks may significantly impact additional products due to scope change, this vulnerability serves as a potential pivot point for deeper infiltration into the broader Oracle Analytics ecosystem or connected backend data warehouses. This interconnectedness amplifies the risk profile, turning what might seem like an isolated application flaw into a systemic enterprise security issue requiring immediate attention and comprehensive remediation strategies across all affected components and integrated systems.
Mitigation efforts must prioritize applying the latest vendor-provided patches to bring all instances of Oracle BI Publisher up to secure versions that address this specific Web Server vulnerability. Organizations should also implement strict network segmentation to limit HTTP access to only necessary administrative or user endpoints, reducing the attack surface available to low-privileged attackers. Additionally, enforcing multi-factor authentication for any account with even minimal privileges can add a critical layer of defense against credential-based exploitation. Regular auditing of BI Publisher logs and database activity is recommended to detect signs of unauthorized data manipulation or unusual access patterns that may indicate an ongoing exploit attempt. Security teams should also review the integration points between BI Publisher and other Oracle products to ensure that compensating controls are in place to prevent lateral movement if a breach occurs.