CVE-2026-83310 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the BI Platform Security component of Oracle Analytics, specifically affecting Oracle BI Publisher versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. This flaw represents a critical security deficiency that allows for unauthorized manipulation or access to sensitive data stored within the reporting platform. The vulnerability is classified as easily exploitable by an attacker with low privileges who has network access via HTTP. Despite requiring human interaction from a user other than the initial attacker, such as clicking on a malicious link or opening a crafted document, the ease of exploitation and the high impact score indicate a severe risk to organizational data integrity and confidentiality. The requirement for user interaction suggests that social engineering tactics may be employed by threat actors to trigger the exploit, leveraging trust within an organization to bypass automated security controls.
From a technical perspective, this vulnerability enables unauthorized creation, deletion, or modification of critical data accessible through Oracle BI Publisher. Furthermore, it grants attackers the ability to read sensitive information that should remain restricted based on role-based access control policies. The impact extends beyond the immediate application due to scope change characteristics inherent in the CVSS scoring model. While the flaw is located within Oracle BI Publisher, successful exploitation can lead to broader compromises across additional products integrated with or dependent upon this platform. This lateral movement potential significantly amplifies the risk profile, as attackers may use compromised BI data as a foothold for further intrusion into connected enterprise systems. The high confidentiality and integrity impacts underscore the severity of potential data exfiltration and tampering events that could result in regulatory violations, financial loss, or reputational damage.
In terms of industry standard classifications, this vulnerability aligns with CWE-20 Improper Input Validation if the flaw stems from inadequate sanitization of user-supplied input via HTTP requests. It also relates to CWE-862 Missing Authorization when low-privileged users are able to perform actions reserved for higher-level administrators or other roles. The requirement for human interaction maps directly to ATT&CK technique T1534, which covers Internal Spearphishing where attackers use social engineering within an organization's network to gain initial access. Additionally, the ability to modify and delete data corresponds to ATT&CK tactic TA0005, Defense Evasion or TA0007, Discovery depending on whether the modifications are intended to hide tracks or gather intelligence for further attacks. The high availability of attack vectors via HTTP indicates that network-based defenses must be carefully configured to inspect traffic destined for BI Publisher endpoints.
Mitigation strategies should prioritize immediate patching by applying the latest security updates provided by Oracle for all affected versions listed, including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0. Organizations must ensure that their update management processes are agile enough to deploy these patches promptly given the high CVSS score of 8.7. In environments where patching is not immediately feasible, compensating controls should be implemented such as restricting network access to BI Publisher interfaces through strict firewall rules and web application firewalls capable of detecting anomalous HTTP requests. Implementing multi-factor authentication for all users with access to the platform can also mitigate the risk associated with credential theft or social engineering attacks that might precede exploitation. Security awareness training is crucial to educate employees about recognizing suspicious links or documents, thereby reducing the likelihood of successful human interaction triggers required by this vulnerability. Continuous monitoring and logging of BI Publisher activities should be enhanced to detect any unauthorized data modifications or access patterns indicative of an ongoing exploit attempt.