CVE-2026-83314 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Web Service API component of Oracle BI Publisher, a core part of the Oracle Analytics suite. This flaw affects specific legacy and current versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability is characterized by an easily exploitable condition that allows a low-privileged attacker with network access via SOAP to compromise the integrity and availability of the Oracle BI Publisher environment. This indicates a significant security gap in how the application handles incoming web service requests, particularly those processed through its Simple Object Access Protocol interface.
From a technical perspective, the flaw likely stems from insufficient input validation or improper authorization checks within the SOAP endpoint handlers. An attacker can craft malicious SOAP messages that bypass existing access controls due to the low privilege requirement for exploitation. This suggests that while general user authentication is required, the specific API endpoints do not enforce strict role-based access control (RBAC) or parameter sanitization necessary to prevent unauthorized operations. The ability to execute these attacks over a network makes this a remote vulnerability, significantly increasing its risk profile compared to local-only exploits.
The operational impact of successful exploitation is severe and multifaceted. First, the attacker gains the capability to perform unauthorized creation, deletion, or modification of critical data within Oracle BI Publisher. This directly compromises the integrity of business intelligence reports, datasets, and configuration settings. Such actions can lead to significant data corruption, loss of sensitive information, or manipulation of analytical outputs which may influence high-level decision-making processes relying on accurate reporting. Second, the vulnerability allows for denial-of-service conditions where an attacker can cause a hang or frequently repeatable crash of the Oracle BI Publisher service. This complete availability impact disrupts business operations and prevents legitimate users from accessing reports and analytics services.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management, as it allows low-privileged actors to perform actions beyond their intended scope. It also relates to CWE-787 Out-of-bounds Write or CWE-20 Improper Input Validation depending on the specific code path exploited for data modification and crashes. From a tactical standpoint, this falls under MITRE ATT&CK techniques such as T1530 Data from Information Repositories if data is exfiltrated or modified, and potentially T1499 Endpoint Denial of Service if the crash mechanism involves resource exhaustion. The CVSS 3.1 base score of 8.1 reflects high severity due to the combination of network accessibility, low attack complexity, no user interaction required, and significant impacts on both integrity and availability.
Mitigation strategies should focus primarily on immediate patching by Oracle for all affected versions listed. Organizations must ensure that their Oracle BI Publisher instances are updated to a version where this Web Service API flaw is resolved. In the interim, network-level controls such as firewalls or web application firewalls can be configured to restrict access to SOAP endpoints only from trusted IP addresses and internal networks. Additionally, implementing strict input validation rules at the gateway level can help mitigate exploitation attempts by filtering out malformed SOAP requests before they reach the vulnerable application logic. Regular auditing of user privileges within Oracle BI Publisher is also recommended to ensure that low-privileged accounts do not have unnecessary access to sensitive web service endpoints until patches are applied.