CVE-2026-83318 in BI Publisher
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Administration component of Oracle BI Publisher, a critical module in the Oracle Analytics suite responsible for managing system configurations and administrative functions. This flaw affects specific legacy and current versions including 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The nature of this defect is characterized as a difficult-to-exploit vulnerability that nonetheless carries severe consequences for system security. It allows an attacker with low privileges to gain unauthorized access through the HTTP interface, ultimately leading to complete takeover of the Oracle BI Publisher application environment.
From a technical perspective, the flaw likely involves improper validation or authorization checks within the administrative endpoints exposed via HTTP. Although the attack complexity is rated as high due to specific exploitation requirements, the availability of network access and low privilege prerequisites makes it accessible to a broader range of threat actors compared to zero-day exploits requiring local system access or complex social engineering. The vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-732 Incorrect Permission Assignment for Critical Resource if the administrative functions rely on insufficient access controls. Additionally, the ability to compromise the application through network-accessible services maps directly to ATT&CK technique T1059 Command and Scripting Interpreter or T1078 Valid Accounts depending on how the low privilege account is leveraged to escalate privileges within the BI Publisher context.
The operational impact of a successful exploitation is severe, as indicated by the CVSS 3.1 base score of 7.5 which denotes high severity. The vector string AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that confidentiality, integrity, and availability are all critically impacted. An attacker achieving takeover can read sensitive business intelligence reports, modify data configurations to alter report outputs for malicious purposes, or disrupt service availability by crashing the application services. This level of compromise undermines trust in the analytics platform and exposes organizations to significant regulatory and reputational risks associated with data breaches and operational downtime.
Mitigation strategies must prioritize immediate patching where available through official Oracle security updates. For environments unable to apply patches immediately due to compatibility constraints, network segmentation is recommended to restrict HTTP access to administrative interfaces strictly from trusted management networks rather than public or general user-facing subnets. Implementing robust web application firewalls can also help detect and block exploitation attempts by filtering anomalous requests targeting the administration component. Regular auditing of low-privilege accounts with administrative capabilities should be conducted to ensure that no single compromised credential provides a path to full system takeover, adhering to the principle of least privilege outlined in industry security frameworks such as NIST SP 800-53 and CIS Benchmarks for Oracle databases and middleware applications.