CVE-2026-83285: Oracle OBIEE Authentication Bypass Vulnerability

CVE-2026-83285 Overview

CVE-2026-83285 is a high-severity vulnerability in the BI Search component of Oracle Business Intelligence Enterprise Edition (OBIEE). The affected version is 12.2.1.4.0. A low-privileged attacker with network access over HTTP can exploit this flaw without user interaction. Successful exploitation grants unauthorized creation, deletion, or modification of critical data. The attacker also gains full read access to OBIEE-accessible data and can cause a partial denial of service.

Critical Impact

An authenticated attacker with only low privileges can compromise the confidentiality and integrity of all data accessible to Oracle Business Intelligence Enterprise Edition and degrade service availability.

Affected Products

• Oracle Business Intelligence Enterprise Edition 12.2.1.4.0
• Oracle Analytics (BI Search component)
• Deployments exposing OBIEE HTTP endpoints to authenticated users

Discovery Timeline

• 2026-09-15 - CVE-2026-83285 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83285

Vulnerability Analysis

The vulnerability resides in the BI Search component of Oracle Business Intelligence Enterprise Edition. BI Search provides indexed query capabilities across dashboards, analyses, and metadata within the OBIEE platform. The flaw allows a low-privileged authenticated user to perform actions beyond their authorization scope. The attack requires network access over HTTP and no user interaction, making automated exploitation feasible in reachable environments.

Impact spans confidentiality, integrity, and availability. An attacker can read, modify, create, or delete data that OBIEE exposes to the application. The availability impact is partial, indicating the attacker can degrade but not fully disable the service. Because BI platforms typically aggregate sensitive business, financial, and customer analytics, the data disclosure risk is significant.

Root Cause

Oracle has not published the underlying weakness classification (CWE) for this issue. Based on the impact profile and the BI Search attack surface, the flaw is consistent with a broken access control or improper authorization issue in HTTP-facing search functionality. Refer to the Oracle Security Alert for vendor-supplied technical context.

Attack Vector

Exploitation occurs over the network via HTTP against the OBIEE application. The attacker requires valid low-privileged credentials to the OBIEE instance. Once authenticated, the attacker issues crafted requests to the BI Search component to reach functionality or data that should require higher privileges. No user interaction is required, and the attack complexity is low. Public proof-of-concept code is not currently available, and the EPSS forecast indicates low near-term exploitation probability.

No verified exploit code is publicly available. See the Oracle Security Alert for advisory details.

Detection Methods for CVE-2026-83285

Indicators of Compromise

• Unexpected HTTP requests from low-privileged accounts to BI Search endpoints under the OBIEE /analytics/ or /bisearch/ URI paths.
• Anomalous data modification, deletion, or creation events in OBIEE audit logs attributed to accounts lacking administrative roles.
• Repeated or scripted search queries originating from a single session with unusually broad result access.

Detection Strategies

• Audit OBIEE WebLogic access logs for HTTP requests to BI Search endpoints correlated with low-privileged session tokens.
• Baseline normal query volume per user role and alert on deviations, especially bursts of privileged-content access from standard users.
• Compare pre- and post-request authorization decisions in OBIEE presentation services logs for mismatches indicating access control bypass.

Monitoring Recommendations

• Forward WebLogic, OBIEE presentation services, and BI Search component logs to a centralized SIEM for correlation.
• Enable Oracle Fusion Middleware audit policies at a level that captures search, read, create, update, and delete events with user attribution.
• Monitor outbound data volumes from OBIEE hosts to detect bulk exfiltration of analytics content.

How to Mitigate CVE-2026-83285

Immediate Actions Required

• Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert as soon as change windows permit.
• Inventory all OBIEE 12.2.1.4.0 deployments, including non-production and disaster recovery instances.
• Review OBIEE user accounts and revoke unnecessary access, particularly for shared or service accounts with network reachability.

Patch Information

Oracle addresses this vulnerability in the corresponding Critical Patch Update. Administrators should consult the Oracle Security Alert for the specific patch identifiers applicable to Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 and follow Oracle's documented application procedure for Fusion Middleware components.

Workarounds

• Restrict network access to OBIEE HTTP endpoints using firewall rules or reverse proxy allowlists limited to trusted corporate networks.
• Enforce strong authentication and short session lifetimes for all OBIEE users to reduce credential misuse risk.
• Disable or restrict access to the BI Search component for user roles that do not require it until patching is complete.

# Example: restrict OBIEE HTTP access at the reverse proxy (nginx)
location /analytics/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://obiee-backend:9502;
}