CVE-2026-83312 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: E-Business Suite - XDO). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle BI Publisher component, specifically affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 of the Oracle Analytics suite integrated with E-Business Suite XDO modules. This security flaw represents a critical weakness in how the application processes incoming HTTP requests from low-privileged users who possess network access to the service. The core technical issue involves an improper validation or handling mechanism that allows an attacker to manipulate input data in a way that bypasses intended authorization controls. Because the vulnerability is exploitable over the network with no requirement for user interaction, it presents a significant remote attack surface. The presence of this flaw indicates a failure in enforcing strict access control policies at the application layer, allowing authenticated but low-privilege users to execute actions or retrieve data beyond their designated permissions.
The operational impact of exploiting this vulnerability is severe due to its direct effect on confidentiality and potential scope expansion. Successful exploitation enables an attacker to gain unauthorized access to critical business data stored within Oracle BI Publisher reports and datasets. The CVSS 3.1 base score of 7.7 reflects a high severity level, primarily driven by the High impact on Confidentiality. This means that sensitive information such as financial records, customer details, or proprietary intellectual property could be exfiltrated without detection. Furthermore, the vulnerability description notes that attacks may significantly impact additional products due to scope changes. This suggests that Oracle BI Publisher likely shares underlying libraries, database connections, or authentication mechanisms with other components of the E-Business Suite or Oracle Analytics stack. Consequently, compromising BI Publisher could serve as a pivot point for lateral movement within the enterprise network, potentially leading to broader system compromise beyond just the reporting module.
From an industry standards perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The ability of low-privileged users to access critical data indicates a breakdown in role-based access control (RBAC) enforcement. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials that have been misconfigured or insufficiently restricted. The network-accessible nature via HTTP also relates to common web application vulnerabilities such as insecure direct object references if the data access relies on predictable identifiers without proper checks. Understanding these mappings helps in categorizing the risk accurately and aligning remediation efforts with established security best practices for enterprise software applications.
Mitigation strategies must prioritize immediate patching of all affected Oracle BI Publisher versions to version 8.2.0.0.1 or later, as well as updates for the specified E-Business Suite XDO components. Organizations should verify their inventory against the supported versions listed in the vendor advisory and apply the latest security patches provided by Oracle. In addition to patching, implementing network-level controls is essential to reduce exposure. This includes restricting HTTP access to BI Publisher services through firewalls or web application firewalls that can inspect for malicious payloads associated with this specific flaw. Enforcing strict least-privilege principles across all user accounts within the E-Business Suite environment will also help mitigate risk by ensuring that even if an account is compromised, its ability to interact with sensitive data remains limited until proper authorization checks are reinforced at the application level.