CVE-2026-83284: Oracle BI Publisher DOS Vulnerability

CVE-2026-83284 Overview

CVE-2026-83284 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically the BI Platform Security component. The flaw allows an unauthenticated attacker with network access via Simple Object Access Protocol (SOAP) to compromise Oracle BI Publisher. Successful exploitation can cause a complete denial of service through a hang or repeatable crash. Attackers can also perform unauthorized update, insert, or delete operations on a subset of accessible data, and read a subset of accessible data. Affected versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.

Critical Impact
Unauthenticated network attackers can crash Oracle BI Publisher and tamper with a subset of accessible data via SOAP requests.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83284 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83284

Vulnerability Analysis

The vulnerability resides in the BI Platform Security component of Oracle BI Publisher. An attacker reaches the vulnerable code path by sending crafted SOAP requests over the network. No authentication or user interaction is required. Exploitation produces three distinct outcomes: a complete denial of service, unauthorized modification of a subset of accessible data, and unauthorized read access to a subset of accessible data. The Exploit Prediction Scoring System (EPSS) score is 0.363% with a percentile of 29.933, indicating moderate near-term exploitation likelihood relative to the broader CVE population.

Root Cause

Oracle has not published detailed root-cause information for this issue. Based on the advisory, the flaw exists in how the BI Platform Security component processes inbound SOAP messages, permitting an unauthenticated caller to trigger both integrity and availability impacts. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-provided technical context.

Attack Vector

The attack vector is network-based over SOAP endpoints exposed by Oracle BI Publisher. An attacker sends malformed or abusive SOAP requests to a reachable BI Publisher instance. Because authentication is not required, any actor with network reachability to the SOAP service can attempt exploitation. Environments exposing BI Publisher to untrusted networks or the internet face the highest exposure.

No public proof-of-concept code has been verified for CVE-2026-83284. See the Oracle Security Alert CSPUSEP2026 for authoritative details.

Detection Methods for CVE-2026-83284

Indicators of Compromise

Repeated or malformed SOAP requests targeting Oracle BI Publisher endpoints from unauthenticated sources.
Unexpected crashes, hangs, or restarts of the BI Publisher service process.
Unexplained modifications, insertions, or deletions in BI Publisher accessible data stores.
Anomalous read patterns against BI Publisher datasets outside normal reporting workflows.

Detection Strategies

Inspect web server and application logs for SOAP POST requests to BI Publisher paths originating from unauthenticated sessions.
Correlate service crash events with preceding inbound SOAP traffic bursts.
Baseline normal SOAP request rates and alert on statistically significant deviations.

Monitoring Recommendations

Enable verbose logging on BI Publisher SOAP endpoints and forward logs to a centralized analytics platform.
Monitor JVM and application-server health metrics for hang conditions and thread exhaustion.
Alert on database write operations executed by BI Publisher service accounts outside scheduled report generation windows.

How to Mitigate CVE-2026-83284

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to affected Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0.
Inventory all BI Publisher deployments and identify instances exposing SOAP endpoints to untrusted networks.
Restrict network access to BI Publisher SOAP endpoints to trusted management and application segments only.

Patch Information

Oracle has published remediation guidance in the Oracle Security Alert CSPUSEP2026. Administrators should consult the advisory for the specific patch bundles and prerequisite patch sets that address CVE-2026-83284 across supported BI Publisher versions.

Workarounds

Place Oracle BI Publisher behind a reverse proxy or web application firewall that filters malformed SOAP payloads.
Disable or block unused SOAP services at the network boundary if they are not required for business operations.
Enforce network segmentation so BI Publisher is not directly reachable from the public internet.

bash

# Example: restrict SOAP endpoint access with iptables to trusted CIDR
iptables -A INPUT -p tcp --dport 9502 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP