CVE-2026-83320: High severity Oracle BI Publisher vulnerability

Published Sep 15, 2026

Updated

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Affected Software

3 affected components

Oracle BI Publisher=8.2.0.0.0

Oracle BI Publisher=12.2.1.4.0

Oracle BI Publisher=26.01.0.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle BI Publisher (Oracle Analytics) - Administration to a version that resolves this vulnerability.
Fixed in 8.2.0.0.0
Upgrade
Upgrade Oracle BI Publisher (Oracle Analytics) - Administration to a version that resolves this vulnerability.
Fixed in 12.2.1.4.0
Upgrade
Upgrade Oracle BI Publisher (Oracle Analytics) - Administration to a version that resolves this vulnerability.
Fixed in 26.01.0.0.0

Event History

Sep 15, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverity

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected supported versions are Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The affected component is Administration.

What must an attacker have to exploit this issue?

An attacker needs network access to the Oracle BI Publisher service over HTTP and low-privileged access. Exploitation also requires interaction by a person other than the attacker.

What is the potential impact of successful exploitation?

An attacker may obtain unauthorized access to critical data or all data accessible through Oracle BI Publisher. They may also be able to update, insert, or delete some accessible data, and the impact can extend to additional products because the vulnerability has scope change.