CVE-2026-83299

Received Received - Intake

Remote Code Execution in Oracle Business Intelligence Enterprise Edition

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83299

EUVD

EUVD-2026-79651

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	business_intelligence_enterprise_edition	12.2.1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. It allows an unauthenticated attacker with network access via HTTP to potentially take over the system. The attack is difficult to exploit but could lead to full compromise of the affected software.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0. Inspect system logs for unusual HTTP traffic patterns or unauthorized access attempts. Verify software versions using commands like 'opatch lsinventory' or checking the Oracle BI installation directory for version files.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over your Oracle Business Intelligence Enterprise Edition system. This could lead to unauthorized access, data theft, system manipulation, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using this software may face legal and regulatory penalties if data is compromised.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle Business Intelligence Enterprise Edition. Restrict network access to the Oracle BI server via firewalls or network segmentation. Monitor for suspicious activity and consider disabling HTTP access if HTTPS is available.

Hi! I’m here to help you understand CVE-2026-83299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70