CVE-2026-83305: Oracle BI Publisher Auth Bypass Vulnerability

CVE-2026-83305 Overview

CVE-2026-83305 is a vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically in the BI Platform Security component. The flaw affects supported versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. An unauthenticated attacker with network access via HTTP can exploit this issue to compromise Oracle BI Publisher. Successful exploitation can result in unauthorized access to all BI Publisher accessible data, unauthorized modification of some data, and a partial denial of service condition.

Critical Impact
Remote unauthenticated attackers can access, modify, and partially disrupt Oracle BI Publisher through HTTP requests without user interaction.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83305 published to NVD
2026-09-16 - Last updated in NVD database
2026-09-16 - EPSS score published at 0.378% (percentile 31.478)

Technical Details for CVE-2026-83305

Vulnerability Analysis

CVE-2026-83305 resides in the BI Platform Security component of Oracle BI Publisher. The vulnerability is reachable over the network via HTTP and does not require authentication or user interaction. An attacker can compromise the application directly by sending crafted requests to the exposed web interface.

Exploitation yields high confidentiality impact, with an attacker gaining full access to data reachable through BI Publisher. Integrity impact is limited but includes unauthorized insert, update, or delete operations against a subset of accessible data. The vulnerability also allows a partial denial of service against the BI Publisher service.

Oracle has not published deeper technical details about the underlying weakness. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative vendor guidance.

Root Cause

Oracle categorizes the flaw under the BI Platform Security component. The advisory indicates a missing or broken security control in the HTTP-facing surface of BI Publisher that permits unauthenticated access to protected data and operations. No specific CWE has been assigned in the NVD record.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker sends HTTP requests to a reachable Oracle BI Publisher instance. Because the attack complexity is low and no privileges or user interaction are required, any internet-exposed or attacker-reachable BI Publisher deployment is at direct risk. No public proof-of-concept is currently listed, and the vulnerability is not on the CISA KEV list.

No verified exploit code is available. Technical mechanics should be validated against the Oracle Security Alert CSPUSEP2026 before drawing exploitation conclusions.

Detection Methods for CVE-2026-83305

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle BI Publisher endpoints originating from unexpected external IP ranges.
Anomalous report generation, data export activity, or record modifications performed without an authenticated session context.
BI Publisher application errors or service restarts consistent with a partial denial of service condition.

Detection Strategies

Inspect web server and application logs for HTTP requests to BI Publisher paths that return successful responses without a valid session or authentication token.
Correlate outbound data transfers from the BI Publisher host with inbound unauthenticated traffic to identify data exfiltration attempts.
Baseline normal request volume and response codes for BI Publisher, then alert on deviations that suggest scanning or exploitation.

Monitoring Recommendations

Forward BI Publisher access logs, WebLogic logs, and reverse proxy logs to a centralized SIEM for correlation.
Monitor database audit logs for read, insert, update, or delete operations initiated by the BI Publisher service account outside of scheduled report activity.
Alert on new administrative report or data model creation events that lack an authenticated user identifier.

How to Mitigate CVE-2026-83305

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected BI Publisher instances.
Inventory all Oracle BI Publisher deployments running versions 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0 and prioritize internet-facing systems.
Review BI Publisher access logs for the last 90 days for signs of unauthenticated access or unexpected data operations.

Patch Information

Oracle addressed CVE-2026-83305 in the Security Alert Advisory CSPUSEP2026. Administrators should download and deploy the patches for their specific BI Publisher version listed in the Oracle Security Alert CSPUSEP2026. Oracle typically requires application of the full Critical Patch Update or Security Alert bundle rather than isolated fixes.

Workarounds

Restrict network access to BI Publisher management and reporting endpoints using firewall rules or a reverse proxy allowlist until patches are applied.
Place BI Publisher behind an authenticated web application firewall or identity-aware proxy that enforces authentication before requests reach the application.
Disable or remove BI Publisher instances that are not required for business operations.

bash

# Configuration example: restrict inbound HTTP access to trusted management network
iptables -A INPUT -p tcp --dport 9502 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP