CVE-2026-83312: Oracle BI Publisher Information Disclosure

CVE-2026-83312 Overview

CVE-2026-83312 is an information disclosure vulnerability in the Oracle BI Publisher product of Oracle Analytics. The flaw resides in the E-Business Suite XDO component. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise Oracle BI Publisher. The vulnerability causes a scope change, meaning successful exploitation may impact resources beyond BI Publisher itself. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data.

Critical Impact
Authenticated attackers can obtain unauthorized read access to sensitive data across Oracle BI Publisher and adjacent components through HTTP-based exploitation.

Affected Products

Oracle BI Publisher 8.2.0.0.0
Oracle BI Publisher 12.2.1.4.0
Oracle BI Publisher 26.01.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-83312 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83312

Vulnerability Analysis

The vulnerability affects the XDO component used by Oracle BI Publisher when integrated with Oracle E-Business Suite. XDO handles XML data processing and report generation within BI Publisher. The flaw permits an attacker holding low-level application privileges to reach protected data through HTTP requests. Confidentiality is fully compromised, while integrity and availability remain unaffected.

The scope change property is significant. It indicates that a successful attack against the vulnerable BI Publisher component can affect resources managed by other security authorities. This expands the blast radius beyond the initially compromised product into connected Oracle Analytics or E-Business Suite tenants.

Root Cause

Oracle's advisory does not disclose the underlying code defect. Based on the CVSS metrics and the component involved, the flaw is consistent with an information disclosure weakness in the XDO XML processing or authorization layer. The vulnerability allows a low-privileged actor to bypass intended access boundaries and read data belonging to other users or tenants.

Attack Vector

Exploitation requires network access via HTTP and valid low-privilege credentials on the BI Publisher instance. No user interaction is required, and exploitation complexity is low. An attacker submits a crafted HTTP request to the vulnerable XDO endpoint. The server returns data the attacker should not be authorized to read, including report data, connection metadata, or content from adjacent Oracle components.

Refer to the Oracle Security Alert CSPUSEP2026 advisory for vendor technical details.

Detection Methods for CVE-2026-83312

Indicators of Compromise

Anomalous HTTP requests to BI Publisher XDO endpoints originating from accounts with low privilege levels.
Unexpected large response payloads from /xmlpserver/ or related BI Publisher URIs.
Access patterns where a single low-privileged user account enumerates multiple report resources or data sources in a short window.

Detection Strategies

Baseline normal BI Publisher usage per user role, then alert on deviations in request volume, request paths, or response sizes.
Correlate BI Publisher web server access logs with application authentication logs to identify privilege boundary violations.
Inspect WebLogic and BI Publisher audit logs for unauthorized report execution or data source access attempts.

Monitoring Recommendations

Enable verbose HTTP access logging on Oracle HTTP Server or WebLogic instances fronting BI Publisher.
Forward BI Publisher, WebLogic, and E-Business Suite logs to a centralized SIEM for cross-source correlation.
Monitor outbound data volume from BI Publisher servers to detect bulk data extraction attempts.

How to Mitigate CVE-2026-83312

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected BI Publisher deployments.
Inventory all Oracle BI Publisher installations at versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 and prioritize patching internet-exposed instances.
Review BI Publisher user accounts and revoke unnecessary low-privilege accounts that could serve as exploitation footholds.

Patch Information

Oracle has released fixes as part of Security Alert CSPUSEP2026. Administrators should download the applicable patch bundle from My Oracle Support and apply it in a maintenance window following Oracle's documented upgrade procedure. Verify patch application by comparing installed OPatch inventories against Oracle's published fix list.

Workarounds

Restrict network access to BI Publisher HTTP endpoints using firewall rules or reverse proxy allow-lists until patching completes.
Enforce strong authentication and multi-factor authentication for all BI Publisher accounts to reduce the pool of viable attackers.
Segment BI Publisher servers from unrelated production systems to limit the impact of the scope-change property.

bash

# Configuration example: restrict BI Publisher access at the reverse proxy
# Example nginx allow-list for the xmlpserver path
location /xmlpserver/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://bip-backend;
}