CVE-2026-83319: Oracle BI Publisher Information Disclosure

CVE-2026-83319 Overview

CVE-2026-83319 is a high-severity vulnerability in the Oracle BI Publisher product of Oracle Analytics. The flaw resides in the Web Service API component and affects version 12.2.1.4.0. A low-privileged attacker with network access via Simple Object Access Protocol (SOAP) can exploit this issue to gain unauthorized access to critical data or complete access to all data accessible through Oracle BI Publisher.

The vulnerability carries a scope change, meaning successful exploitation may significantly impact additional Oracle products beyond BI Publisher itself. Oracle disclosed the flaw in a security alert published in September 2026.

Critical Impact
Authenticated attackers can extract confidential data across Oracle BI Publisher and connected systems via crafted SOAP requests, with scope change amplifying blast radius beyond the vulnerable component.

Affected Products

Oracle BI Publisher (Oracle Analytics)
Affected version: 12.2.1.4.0
Component: Web Service API (SOAP interface)

Discovery Timeline

2026-09-15 - CVE-2026-83319 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
2026-09-15 - Oracle publishes Security Alert CSPUSEP2026

Technical Details for CVE-2026-83319

Vulnerability Analysis

The vulnerability affects the Web Service API component of Oracle BI Publisher, which exposes SOAP endpoints used for programmatic report generation, scheduling, and data source interaction. An authenticated attacker holding low-privilege credentials can craft SOAP requests that bypass intended access boundaries and read data the account should not be permitted to see.

The scope change indicator signals that a successful attack extends beyond BI Publisher's own security context. Because BI Publisher frequently connects to backend Oracle databases, Analytics Server components, and shared credential stores, information reachable through the compromised service may include credentials, report content, and connected data source records.

The impact is confined to confidentiality. Integrity and availability of the target are not directly affected, but exfiltrated data can enable follow-on attacks against connected Oracle systems.

Root Cause

Oracle has not disclosed a specific Common Weakness Enumeration (CWE) classification. The vulnerability pattern is consistent with insufficient authorization enforcement on SOAP-exposed Web Service API methods, allowing a low-privileged authenticated principal to invoke operations or reference resources reserved for higher-privileged users.

Attack Vector

Exploitation requires network reachability to the BI Publisher SOAP endpoints and valid low-privilege credentials. No user interaction is required, and attack complexity is low. An attacker sends specially crafted SOAP calls to the vulnerable Web Service API operations to trigger unauthorized data disclosure.

Refer to the Oracle Security Alert CSPUSEP2026 for the authoritative technical description and patch matrix.

Detection Methods for CVE-2026-83319

Indicators of Compromise

Unexpected SOAP requests to BI Publisher Web Service API endpoints (/xmlpserver/services/) originating from low-privileged accounts.
Anomalous volumes of report or data source metadata queries within short time windows.
Authentication events from service accounts executing SOAP operations they historically have not invoked.

Detection Strategies

Enable verbose logging on the BI Publisher SOAP endpoints and forward logs to a centralized analytics platform for behavioral baselining.
Correlate authenticated SOAP API calls with the requesting account's role to identify calls that exceed the account's least-privilege scope.
Alert on repeated SOAP faults or authorization errors, which may indicate enumeration attempts against protected operations.

Monitoring Recommendations

Monitor outbound data volumes from BI Publisher hosts for unusual spikes indicating bulk report or metadata extraction.
Track access to shared credential stores and connected data sources referenced by BI Publisher jobs.
Review Oracle Analytics audit logs weekly for account privilege drift and unexpected SOAP client user agents.

How to Mitigate CVE-2026-83319

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all Oracle BI Publisher 12.2.1.4.0 deployments.
Inventory all BI Publisher instances, including non-production environments, and confirm the patch is applied uniformly.
Rotate credentials for accounts and data sources reachable through BI Publisher if exposure is suspected.

Patch Information

Oracle addressed the vulnerability in Security Alert CSPUSEP2026 published September 15, 2026. Administrators should follow the patch matrix in the advisory and validate the fixed component version after deployment.

Workarounds

Restrict network access to BI Publisher Web Service API endpoints using firewall rules or reverse-proxy allow-lists limited to trusted hosts.
Disable unused SOAP services on the BI Publisher deployment where operationally feasible.
Enforce least privilege for all BI Publisher accounts and audit role assignments that grant Web Service API access.

bash

# Example: restrict access to BI Publisher SOAP endpoints at the reverse proxy
location /xmlpserver/services/ {
    allow 10.10.20.0/24;   # trusted integration subnet
    deny  all;
    proxy_pass http://bi-publisher-backend;
}