CVE-2026-83303

Deferred Deferred - Pending Action

Oracle BI Publisher Data Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83303

EUVD

EUVD-2026-79655

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	bi_publisher	8.2.0.0.0
oracle	bi_publisher	12.2.1.4.0
oracle	bi_publisher	26.01.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle BI Publisher, part of Oracle Analytics. It allows a low-privileged attacker with network access to exploit it via SOAP. The flaw enables unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to some data.

Detection Guidance

Detection requires checking if Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 are installed and exposed to network access via SOAP. Review server logs for unusual SOAP requests targeting Oracle BI Publisher endpoints. Use network scanning tools to identify open ports and services associated with Oracle BI Publisher.

Impact Analysis

If exploited, this vulnerability could allow attackers to modify or delete sensitive data, or access confidential information within Oracle BI Publisher. This could lead to data breaches, loss of data integrity, or unauthorized data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access, modification, or deletion. It may result in legal penalties, loss of trust, and reputational damage.

Mitigation Strategies

Immediately apply the latest Oracle Critical Patch Update for Oracle BI Publisher. Restrict network access to Oracle BI Publisher via firewall rules to limit exposure. Ensure only trusted users have low-privilege access. Monitor for unauthorized data access or modifications in Oracle BI Publisher logs.

Hi! I’m here to help you understand CVE-2026-83303. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70