CVE-2026-83267 Overview
CVE-2026-83267 affects the Oracle BI Publisher product within Oracle Analytics, specifically the BI Publisher Security component. The flaw allows a low-privileged attacker with network access over HTTP to compromise Oracle BI Publisher. Because the vulnerability triggers a scope change, successful exploitation extends impact to additional products beyond BI Publisher itself. Attackers can gain unauthorized access to all data reachable by Oracle BI Publisher and perform unauthorized update, insert, or delete operations on a subset of that data.
Critical Impact
A low-privileged remote attacker can obtain complete read access to Oracle BI Publisher data and modify a subset of it, with impact extending beyond BI Publisher due to scope change.
Affected Products
- Oracle BI Publisher version 8.2.0.0.0
- Oracle BI Publisher version 12.2.1.4.0
- Oracle BI Publisher version 26.01.0.0.0
Discovery Timeline
- 2026-09-15 - CVE-2026-83267 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-83267
Vulnerability Analysis
The vulnerability resides in the BI Publisher Security component of Oracle BI Publisher, part of the Oracle Analytics product family. An authenticated attacker holding only low privileges can reach the vulnerable code path across the network using HTTP requests, without any user interaction. Exploitation yields high confidentiality impact and low integrity impact, while availability remains unaffected.
The scope change signals that the compromised BI Publisher process influences resources managed by a different security authority. As a result, attackers can pivot from BI Publisher into adjacent Oracle products that trust or share data with it. Reporting subsystems, embedded analytics, and downstream data consumers are all potential targets once initial access is achieved.
Root Cause
Oracle has not published detailed technical root-cause information. Based on the affected component (BI Publisher Security) and the CVSS profile indicating low privileges, network reachability, and scope change, the weakness is consistent with a broken access control or authorization flaw in security-enforcement logic exposed to authenticated users. Confirmed technical detail is available only through the Oracle Security Alert CSPUSEP2026.
Attack Vector
An attacker authenticates to Oracle BI Publisher with any low-privilege account and issues crafted HTTP requests to the vulnerable BI Publisher Security endpoint. The request bypasses intended authorization checks and returns data the account should not be able to read. The same channel enables limited write operations against records within BI Publisher's reach. The Exploit Prediction Scoring System (EPSS) currently reports a probability of 0.316% for this CVE.
No verified public proof-of-concept code is available. See the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-83267
Indicators of Compromise
- Unexpected data exports, report downloads, or large result sets initiated by low-privilege BI Publisher accounts.
- HTTP requests to BI Publisher Security endpoints from accounts that do not normally interact with administrative or security-related URLs.
- Unauthorized create, update, or delete operations on BI Publisher metadata, data models, or report objects.
- Access to datasets or reports outside the requesting user's assigned role scope.
Detection Strategies
- Baseline normal BI Publisher HTTP request patterns per user role and alert on deviations, especially requests to security or administrative paths.
- Correlate authentication events with subsequent report execution and data extraction activity to surface privilege misuse.
- Enable BI Publisher audit logging and forward events to a centralized analytics platform for cross-source correlation.
Monitoring Recommendations
- Monitor Oracle BI Publisher audit logs, WebLogic access logs, and database query logs for the shared service accounts BI Publisher uses.
- Track outbound data volumes from BI Publisher hosts to identify bulk data exfiltration attempts.
- Alert on new or modified data sources, report definitions, and delivery destinations created by non-administrative users.
How to Mitigate CVE-2026-83267
Immediate Actions Required
- Apply the Oracle security patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected BI Publisher installations.
- Inventory all Oracle BI Publisher deployments and confirm versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 are prioritized for remediation.
- Review BI Publisher user accounts and revoke unused low-privilege accounts that could serve as an entry point.
- Rotate credentials for BI Publisher service accounts and data source connections after patching.
Patch Information
Oracle released fixes as part of the CSPUSEP2026 security alert cycle. Administrators should download and apply the patches identified in the Oracle Security Alert CSPUSEP2026 advisory for each affected BI Publisher release train. Validate patch installation against Oracle's post-patch verification steps before returning systems to production use.
Workarounds
- Restrict network access to Oracle BI Publisher HTTP endpoints to trusted networks and identity-aware proxies until patches are applied.
- Enforce multi-factor authentication on all BI Publisher user accounts to raise the cost of low-privilege account compromise.
- Apply the principle of least privilege to BI Publisher roles and remove unnecessary data source access for standard user accounts.
- Enable and centralize BI Publisher audit logs so any exploitation attempt during the patch window is captured for investigation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
