CVE-2026-83310: Oracle BI Publisher Privilege Escalation

CVE-2026-83310 Overview

CVE-2026-83310 is a high-severity vulnerability in Oracle BI Publisher, part of the Oracle Analytics product family. The flaw resides in the BI Platform Security component and affects Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access via HTTP can exploit the issue, though successful exploitation requires interaction from a user other than the attacker. The vulnerability produces a scope change, meaning attacks may impact additional products beyond Oracle BI Publisher itself. Successful exploitation grants unauthorized creation, deletion, or modification of critical data and unauthorized read access to all Oracle BI Publisher accessible data.

Critical Impact
Attackers can compromise the confidentiality and integrity of all data accessible through Oracle BI Publisher, with impact extending beyond the vulnerable component due to a scope change.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83310 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83310

Vulnerability Analysis

The vulnerability affects the BI Platform Security component of Oracle BI Publisher, an enterprise reporting product within Oracle Analytics. An authenticated attacker with low privileges can send crafted HTTP requests to the BI Publisher instance. Exploitation requires a separate victim user to perform an action, indicating that the attack likely involves tricking a legitimate user into loading attacker-controlled content or following a malicious link within the application context.

The scope change indicates that a successful attack crosses trust boundaries. Code or actions executed within Oracle BI Publisher can influence resources managed by other components or products in the deployment. This behavior is consistent with vulnerabilities where user session context, tokens, or platform-level credentials can be reused against downstream systems.

Successful exploitation results in unauthorized create, read, update, and delete operations on all data accessible to the compromised BI Publisher account, without affecting availability.

Root Cause

Oracle has not published detailed root-cause information for this issue. The advisory categorizes the defect within the BI Platform Security component. Based on the requirement for user interaction combined with a scope change and confidentiality plus integrity impacts, the flaw is consistent with a client-side injection or request-forgery class weakness in the BI Publisher web interface.

Attack Vector

The attack originates over the network using HTTP against the Oracle BI Publisher web tier. The attacker must hold low-privileged credentials to the application. Delivery requires a second user, typically higher-privileged, to interact with attacker-supplied content served through BI Publisher. Once interaction occurs, the attacker gains unauthorized access to data and operations spanning BI Publisher and connected products.

Oracle has not released proof-of-concept code. Technical details are available in the Oracle Security Alert CSPUSEP2026.

Detection Methods for CVE-2026-83310

Indicators of Compromise

Unexpected report creation, modification, or deletion events in BI Publisher audit logs originating from low-privileged accounts.
HTTP requests to BI Publisher endpoints containing unusual template parameters, embedded scripts, or references to external resources.
Authenticated sessions from a high-privileged user accessing BI Publisher content shortly after a low-privileged user uploaded or shared new content.
Outbound connections from BI Publisher application servers to unfamiliar destinations following user interaction with shared reports.

Detection Strategies

Enable and centralize Oracle BI Publisher audit logs, then correlate report creation, sharing, and rendering events against user privilege levels.
Monitor web application firewall (WAF) logs for HTTP requests to BI Publisher paths containing suspicious payloads in parameters, headers, or report definitions.
Baseline normal report authoring behavior per user and alert on deviations such as sudden bulk report creation by low-privileged accounts.

Monitoring Recommendations

Forward BI Publisher, web server, and reverse proxy logs into a centralized analytics platform for cross-source correlation.
Track privileged user sessions that render or interact with reports authored by low-privileged users.
Alert on any BI Publisher process spawning unexpected child processes or making unusual outbound network calls, indicating scope-change exploitation.

How to Mitigate CVE-2026-83310

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected Oracle BI Publisher instances.
Inventory Oracle BI Publisher deployments running versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 and prioritize internet-exposed systems.
Review and reduce the privileges of BI Publisher accounts, especially any accounts shared between users or services.
Restrict administrative and privileged BI Publisher access to isolated networks or bastion hosts pending patch deployment.

Patch Information

Oracle has published fixes as part of the CSPUSEP2026 security alert. Administrators should apply the vendor-provided patches for each affected version. Refer to the Oracle Security Alert CSPUSEP2026 for exact patch identifiers, prerequisites, and installation guidance.

Workarounds

Place Oracle BI Publisher behind a web application firewall configured to inspect and filter report authoring and rendering requests.
Enforce role separation so that low-privileged authoring accounts cannot share content directly with administrative users without review.
Disable or restrict BI Publisher features that permit embedding of external content in reports until patches are applied.
Require multi-factor authentication for all BI Publisher accounts to reduce the value of any credentials obtained through prior compromise.

bash

# Example: restrict HTTP access to BI Publisher management endpoints at the reverse proxy
# (adapt paths and IP ranges to your environment)
location /xmlpserver/servlet/admin {
    allow 10.0.0.0/24;      # trusted admin subnet
    deny  all;
    proxy_pass http://bi_publisher_backend;
}